Keeping your code secure
summary
AWS built a single SAST engine that powers Amazon Q Developer, CodeGuru Security, and Amazon Inspector, running 2000 detection rules across 10 languages and covering Top 10 and CWE Top 25 vulnerabilities; the pipeline filters third‑party code, includes secret and IaC scanning, and uses a MuGraph program representation plus the Guru Query Language to express precise detectors. A partitioning algorithm (FSE 2022) parallelizes analysis, and remediation comes from a mix of rulebased transforms and LLM‑powered auto‑fix for 5 languages today.
AI-written summary · about
chapters (14)
- 0:00Introduction to talk
- 1:05Why code security matters
- 9:50Shift-left security approach
- 12:46Inconsistent findings problem
- 16:41Reducing false positives
- 19:35Developer-friendly tools
- 23:57Domain knowledge gap
- 25:44AI-generated insecure code
- 28:12Code scanning engine overview
- 31:15Code partitioning engine
- 33:49Detectors and MuGraph
- 45:19Auto-fix with generative AI
- 47:56Live demo walkthrough
- 53:27Summary and Q&A
related talks
48mFrom IDE to production: Actionable ML-powered code security analysis
18mImproving code security analysis with AI/ML
56mContinuous innovation in AWS detection and response services
56mMore easily validate the components of the software you build
01h 08mKeynote
01h 00mVulnerability management at scale drives enterprise transformation
19mFrom code to insight: Amazon Inspector & AWS Lambda in action
14mDeveloping and deploying secure AWS Lambda applications