PERL,INGRES,PROGRAMMING

  Bumblebee is an open-source security tool developed by Perplexity AI to identify software supply chain vulnerabilities on developer workstations. https://www.i-programmer.info/news/90-tools/18945-perplexity-releases-the-bumblebee-supply-chain-security-scanner.html

  Vercel has launched Deepsec, an open-source security tool designed to find complex vulnerabilities in large codebases using autonomous AI agents. https://www.i-programmer.info/news/90-tools/18936-vercels-deepsec-scans-your-code-with-agentic-ai.html

  It's been some years since we first looked at Qodana, the solid SAST tool from JetBrains. Let's find out what's new in its latest release, Qodana 2025.2. https://www.i-programmer.info/news/90-tools/18398-qodana-revisited-.html

Bearer is a code security scanning tool (SAST) under secretive development for the last two years that discovers, filters and prioritizes security risks and vulnerabilities. Now it's ready and has been open sourced. https://www.i-programmer.info/news/90-tools/16209-bearer-a-new-sast-tool-on-the-block.html

  JetBrains' integrated code quality platform moves from locally hosted development environments to the cloud. Why is that great? Back in October 2021 when Qodana went public,  we reported  that the tool was not just a mere linter: While Qodana's job is to identify and suggests fixes for bugs, security vulnerabilities, duplications, imperfections, anomalous code, probable bugs, dead code, etc, it is also a complete Code Quality Platform with the aim of improving the overall code structure of a project by applying the best coding practices as well as providing integrations and visualizations of inspections and errors right in your favorite JetBrains IDE. https://www.i-programmer.info/news/90-tools/15929-jetbrains-qodana-moves-to-the-cloud.html

 Error Prone is a new Java compiler plugin created by Google which checks your code for common errors at compile-time. Not does only Error Prone identify issues but suggests their fixes too by analyzing the code’s abstract syntax tree (AST). An example from the official documentation will make its use clear : full article on i-programmer: https://www.i-programmer.info/news/80-java/15811-check-your-java-with-error-prone.html

 Qodana is a new offering by Jetbrains. It detects and flags programming errors, but it's much more than that - it's a complete Code Quality Platform. While Qodana's job is to identify and suggests fixes for bugs, security vulnerabilities, duplications, imperfections, anomalous code, probable bugs, dead code, etc, it is also a complete Code Quality Platform with the aim of improving the overall code structure of a project by applying best coding practices. In particular note that Qodana can "provide project analysis locally or in any CI" .As such developers can have the same universal set of inspections across their Jetbrains IDEs as well as their CI pipeline, including JetBrains Space, TeamCity, GitHub Actions, Jenkins, and GitLab CI. full article on i-programmer.info: https://www.i-programmer.info/news/90-tools/14958-jetbrains-qodana-more-than-just-a-linter.html

The Open Source Security Foundation has recently launched three brand new and free courses on Secure Software Development, which are hosted on edX. Nowadays every company is a software house regardless of the business it is in be it finance, manufacturing or healthcare. To provide value, businesses have to communicate through software applications built in-house or by a third party. The problem is that cyberattackers will attack those applications, probing them to uncover vulnerabilities to exploit and get access to your internal networks, steal company and customer data or just create havoc. full article on i-programmer

DeepCode, a SAST tool bug finder based on machine learning, can now be used seamlessly from within IntelliJ, PyCharm, and WebStorm. There's a lot of interest lately on Static Application Security Testing (SAST) Tools, and that has to do with the fact that the software written today is very complex and very large - a simple code review by humans won't cut it anymore. Thus the introduction of SAST tools into the CI/CD pipeline and more specifically at the Commit-time and Test-time check phases.We've recently covered a new hybrid kind of tool of the genre, in " Semgrep - More Than Just a Glorified Grep" , which occupies a space somewhere in between grep and a SAST tool - more expressive than grep, but not as hard to tweak and learn as a SAST. on i-programmer

Introducing a tool to search through code for flaws where plain regexes fall flat and using Static Application Security Testing would be overkill. Semgrep proclaims itself as: "a tool for easily detecting and preventing bugs and anti-patterns in your codebase. It combines the convenience of grep with the correctness of syntactical and semantic search". It isn't just a glorified grep, though. It occupies a space somewhere in between grep and a SAST tool - more expressive than grep, but not as hard to tweak and learn as a SAST. on i-programmer