Applying AI-assisted remediation recommendations

Edit online

You can use AI-assisted remediation recommendations to help resolve vulnerabilities identified by Static Application Security Testing (SAST) scans in Concert Secure Coder.

AI-assisted remediation recommendations analyze identified vulnerabilities and suggest code changes that can help remediate the issue. Recommendations are displayed directly in your IDE and can be reviewed before you apply them.

In the user interface, AI-assisted remediation recommendations are provided through the Fix with AI capability.

Before you begin

Ensure that:
  • Concert Secure Coder is installed and authenticated.
  • Static Application Security Testing (SAST) scanning is enabled for your organization.
  • The required AI integration is configured for your Concert Secure Coder installation.
  • You completed a SAST scan and identified vulnerabilities.
Note: AI-assisted remediation recommendations are available only when AI remediation capabilities are configured for your Concert Secure Coder installation.

Apply an AI-assisted remediation recommendation

Note: AI-generated remediation suggestions from IBM Bob are assistive and not authoritative. Determine the appropriate level of review needed, and always review, test, and approve remediations before applying them.
  1. In the Concert Secure Coder panel, click Workspace scans.
  2. Run a Static Application Security Testing (SAST) scan.
  3. In the scan results, expand a vulnerability to view its details.
  4. Select the vulnerability that you want to remediate.
  5. Click Fix with AI.

    The AI recommendation opens in the editor.

  6. Review the proposed code changes.
    The recommendation displays a side-by-side comparison that shows:
    • Your current code.
    • The recommended code changes.
  7. Secure Coder does not automatically commit, merge, deploy, or execute generated code changes . Review the recommendation and choose one of the following actions:
    • Accept Fix to apply the recommended changes to your code.
    • Reject Fix to discard the recommendation.
    Note: AI generated fix suggestions are provided for review purposes only. Customer engineers are responsible for evaluating, testing, and approving all generated recommendations before any changes are applied.
  8. Any pull requests should be validated by your testing, QA, security checks, and CI/CD processes before integration. If you apply the recommendation, review the updated code and validate that the issue is resolved.
  9. Run the SAST scan again to verify that the vulnerability is no longer reported.

Important considerations

  • AI-assisted remediation recommendations are available only for supported SAST findings.
  • Secure Coder generates fix suggestions that must be reviewed and approved by your engineers before use.
  • Generated pull requests are not automatically committed, merged, deployed, or executed.
  • If an AI assisted recommendation is not available, review the vulnerability details and remediate the issue manually.

Next steps

After applying a recommendation, rerun the relevant scans and review the results to confirm that the vulnerability has been resolved.