Remediate vulnerabilities with Concert Secure Coder

Edit online

Concert Secure Coder is an IDE-based experience that helps developers identify and remediate security vulnerabilities during code development. It integrates with IBM Concert to provide security insights, vulnerability detection, and remediation recommendations directly within supported development environments.

By using Concert Secure Coder, developers can identify issues earlier in the software development lifecycle, review findings within their development environment, and remediate vulnerabilities before code progresses through downstream delivery pipelines.

What you can do with Concert Secure Coder

With Concert Secure Coder, you can:
  • Scan files and repositories for security vulnerabilities.
  • Detect exposed secrets and configuration issues.
  • Identify vulnerabilities in open source dependencies.
  • Apply AI-assisted remediation recommendations when available.
  • View security exposure data from IBM Concert.
  • Upgrade vulnerable packages to recommended versions.

Available scanning capabilities

Concert Secure Coder supports multiple scanning and remediation capabilities that can be enabled based on your organization's configuration.

Available capabilities include:
  • Secrets detection
  • Static Application Security Testing (SAST)
  • Software Composition Analysis (SCA)
  • AI-assisted remediation recommendations

Secrets detection, Static Application Security Testing (SAST), Software Composition Analysis (SCA), and AI-assisted remediation recommendations can be enabled or disabled based on your organization's configuration. Capabilities that are not enabled remain visible in the user interface but cannot be used until they are configured by an administrator.

Supported environments

Concert Secure Coder supports the following environments.

Supported IDEs
  • Visual Studio Code version 1.98.0 or later
  • IBM Bob

Supported languages

The following languages are supported for Static Application Security Testing (SAST) and Software Composition Analysis (SCA) scans when those capabilities are enabled:
  • Java
  • JavaScript (Node.js)
  • C#
  • Go
  • PHP
  • Python
  • Ruby

How Concert Secure Coder works

Concert Secure Coder consists of the following components:

Secure Coder service

Installed with IBM Concert, the Secure Coder service processes scan requests and integrates with supported security and AI services.

IDE extension

Installed in a supported IDE, the extension enables developers to scan code, review findings, apply remediation recommendations, and view security exposure data from IBM Concert.

The IDE extension communicates with the Secure Coder service to perform scans and retrieve security information.

Before you begin

Ensure that:
  • IBM Concert is installed and configured.
  • The Secure Coder service is installed and available.
  • Required scanning integrations are configured.
  • watsonx.ai is configured if you plan to use AI-assisted remediation recommendations.
  • A supported IDE is installed.
  • The Secure Coder extension is downloaded from IBM Concert.
  • You have a valid IBM Concert API key.

Concert Secure Coder workflow

A typical Secure Coder workflow includes the following activities:
  1. Install and authenticate the Secure Coder extension.
  2. Scan files or repositories for vulnerabilities, exposed secrets, and dependency issues.
  3. Review scan findings and vulnerability details.
  4. Apply AI-assisted remediation recommendations when available.
  5. Upgrade vulnerable dependencies to recommended versions.
  6. Synchronize scan results and exposure information with IBM Concert.
  7. Continue remediation activities until identified issues are resolved.