Troubleshooting Concert Secure Coder

Edit online

If you encounter problems while using Concert Secure Coder, use the following information to diagnose and resolve common issues.

Cannot authenticate to Concert Secure Coder

Symptoms

Authentication fails when you attempt to sign in to the Secure Coder extension.

Resolution

  1. Verify that the Concert URL is correct.

    The URL format is typically: https://<hostname>:12443

  2. Verify that your IBM Concert API key is valid.
  3. If your API key was revoked or expired, generate a new API key from IBM Concert and authenticate again.
  4. Confirm that the Concert Secure Coder service is installed and available.

File scan does not run

Symptoms

A file scan does not start or returns no results.

Resolution

  1. Verify that a supported file is currently open in your editor.
  2. Confirm that the selected scan type supports the file that you are scanning.
  3. Verify that you are authenticated to IBM Concert.
  4. Retry the scan.

Secrets detection scan does not return results

Symptoms

A Secrets detection scan completes but no findings are displayed.

Resolution

If no secrets are detected, the scan completes successfully and no findings are shown.

If you expected findings:
  1. Verify that the correct file or workspace is being scanned.
  2. Confirm that the scan completed successfully.
  3. Review the scan output for any reported errors.

Kubescape scan is unavailable

Symptoms

Kubescape scans do not run or no results are displayed.

Resolution

  1. Verify that the file is a valid Kubernetes manifest.
  2. Confirm that the file uses a supported format:
    • .yaml
    • .yml
  3. If no vulnerabilities or misconfigurations are detected, no findings are displayed.

Workspace scan fails

Symptoms

A workspace scan fails or does not complete successfully.

Resolution

  1. Verify that a valid workspace or repository is open.
  2. Confirm that the repository size does not exceed 500 MB.
  3. Verify that you are authenticated to IBM Concert.
  4. Retry the scan.
  5. If scans consistently time out, increase the Workspace scan timeout value in the Secure Coder settings.

Workspace scan option is unavailable

Symptoms

A workspace scan type appears in the interface but cannot be selected.

Resolution
  1. Verify that the scan capability is enabled for your organization.
  2. Secrets detection, Static Application Security Testing (SAST), and Software Composition Analysis (SCA) capabilities can be enabled or disabled independently.
  3. Contact your administrator if a required scan capability is unavailable.

SAST or SCA scans are unavailable

Symptoms

The SAST or SCA scan options are visible but cannot be selected.

Resolution
  1. Verify that the required scanning capabilities are enabled for your Concert Secure Coder installation.
  2. Contact your administrator if the capabilities are not available.

AI-assisted remediation recommendations are unavailable

Symptoms

The Fix with AI option is not available.

Resolution

AI-assisted remediation recommendations are available only when all of the following conditions are met:
  • The finding was identified by a SAST scan.
  • The required SAST scanning capability is enabled.
  • watsonx.ai integration is configured.
  • AI-assisted remediation recommendations are enabled for your Secure Coder installation.

AI-assisted remediation recommendations fail

Symptoms

An error occurs when generating an AI-assisted remediation recommendation.

Resolution

  1. Verify that the finding originated from a SAST scan.
  2. Retry the operation.
  3. Some complex code structures might not support AI-generated remediation recommendations.

Concert exposure data is unavailable

Symptoms

The Concert exposures tab is empty or does not display expected results.

Resolution

  1. Verify that the repository is recognized by IBM Concert.
  2. Open the Home tab.
  3. Click Sync all scans to refresh repository data.
  4. Wait for synchronization to complete and review the exposures again.

Workspace scans time out

Symptoms

A workspace scan stops before completion and returns a timeout error.

Resolution

Increase the Workspace scan timeout setting.

The timeout:
  • Controls how long a workspace scan can run before timing out.
  • Supports values from 1 to 60 minutes.
  • Uses 10 minutes as the default value.
This setting applies to:
  • Secrets detection scans
  • SAST scans
  • SCA scans

Larger repositories might require a longer timeout value.

Collect extension logs

If you need additional troubleshooting information:
  1. Open the IDE output panel.
  2. Review the Concert Secure Coder extension logs.
  3. Collect relevant error messages.
  4. Provide the log information when contacting your support team.

Additional troubleshooting resources

If issues persist, contact your IBM Support and provide:
  • A description of the issue
  • Relevant error messages
  • Extension log output
  • Steps to reproduce the problem