Comprehensive suite for advanced real-time code analysis and security

1 . At least one non-transitory, computer-readable storage medium comprising instructions recorded thereon, wherein the instructions, when executed by at least one data processor of a system, cause the system to:

receive a proposed change to a codebase,

wherein the codebase comprises a collection of files including texts written in one or more programming languages,

wherein the proposed change comprises one or more changes to one or more files in the codebase;

determine a code context for the proposed change based on at least a file type of the one or more files or a programming language used in the one or more files,

wherein the code context corresponds to an application type of the codebase, and

wherein the application type is associated with a set of known security vulnerabilities;

split, by a plurality of code analyzers and based on the code context, the proposed change into code segments,

wherein each of the plurality of code analyzers is configured to analyze a specific aspect of security concerns, and

wherein each of the plurality of code analyzers is configured to split the proposed change into a corresponding set of code segments according to a corresponding aspect of security concerns; and

detect whether a security vulnerability exists in the proposed change by using the plurality of code analyzers to analyze corresponding sets of code segments in parallel.

2 . The at least one non-transitory, computer-readable storage medium of claim 1 , wherein a first code segment contains text from multiple changed files, and wherein the first code segment and a second code segment contain text from a single changed file.

3 . The at least one non-transitory, computer-readable storage medium of claim 1 , further comprising instructions to:

determine a code context for the proposed change based on at least a dependency used by the one or more files in the codebase,

wherein a dependency comprises functions used by the one or more files,

wherein one or more functions of the dependency are associated with a known security vulnerability; and

detect, by a code analyzer, that the known security vulnerability is present in a set of code segments.

4 . The at least one non-transitory, computer-readable storage medium of claim 1 , wherein splitting the proposed change based on code context further comprises:

determine, using a code analyzer, that a changed file has a name or a path that corresponds to a known security vulnerability; and

include text from the changed file in a code segment.

5 . The at least one non-transitory, computer-readable storage medium of claim 1 , wherein splitting the proposed change based on the code context comprises:

determine, based on the code context of a file, that a portion of text in the file does not correspond to executable instructions; and

split, by the plurality of code analyzers, the proposed change based on the code context,

wherein the code segments exclude the portion of text.

6 . The at least one non-transitory, computer-readable storage medium of claim 1 , wherein using code analyzers to analyze a corresponding set of code segments comprises:

identifying assistance data based on the code context; and

processing the assistance data and one or more prompts using a large language model.

7 . The at least one non-transitory, computer-readable storage medium of claim 1 , wherein at least one of the plurality of code analyzers is configured to analyze multiple aspects of security concerns.

8 . The at least one non-transitory, computer-readable storage medium of claim 1 , further comprising instructions to:

receive, from a user, a natural-language security question,

wherein the natural-language security question is associated with a particular security vulnerability; and

detect, at least in part by processing the natural-language security question using a code analyzer, that the particular security vulnerability exists in the proposed change.

9 . The at least one non-transitory, computer-readable storage medium of claim 1 , further comprising instructions to:

anonymize a code segment,

wherein anonymizing a code segment comprises removing data or metadata that identifies a source of the code segment; and

store the anonymized code segment in a repository.

10 . The at least one non-transitory, computer-readable storage medium of claim 1 , further comprising instructions to:

produce a first summary describing results of the detection;

receive a second summary describing results of a second detection of a security vulnerability in a second set of proposed changes from a second codebase; and

generate, based on the first and second summaries, a summary describing changes in the first and second codebases.

11 . A system comprising:

at least one processor; and

at least one memory storing instructions that, when executed by the at least one processor, cause the system to:

identify a first set of security analysis reports,

wherein each security analysis report corresponds to a security analysis performed on a first proposed change for a first codebase,

wherein the first proposed change comprises one or more changes to one or more files in the first codebase, and

wherein each security analysis report comprises output from each of a set of code analyzers used to detect potential security vulnerabilities in the first proposed change;

generate, based on the first set of security analysis reports, a first change request security summary;

generate, based on a second set of security analysis reports corresponding to a second security analysis performed on a second proposed change for a second codebase, a second change request security summary; and

determine a code context for at least one of the first or second proposed changes based on at least a file type of the one or more files or a programming language used in the one or more files,

wherein the code context includes an indication of an application type of the codebase,

wherein the application type is associated with a set of known security vulnerabilities; and wherein the set of code analyzers analyze at least one of the first or second proposed changes, using the code context;

generate, from the first and second change request security summaries, an awareness digest;

wherein the awareness digest identifies security vulnerabilities, detected in both the first and second proposed changes, associated with a particular security concern.

12 . The system of claim 11 , wherein generating the first change request security summary comprises processing the first set of security analysis reports using a large language model (LLM).

13 . The system of claim 11 , further comprising:

generating a second awareness digest from the first and second proposed changes,

wherein the second awareness digest identifies security vulnerabilities, detected in both the first and second proposed changes, associated with a second security concern.

14 . The system of claim 11 , wherein the second codebase is the first codebase.

15 . A computer-implemented method, comprising:

receiving a proposed change for a codebase,

wherein the codebase comprises a collection of files including texts written in one or more programming languages,

wherein the proposed change comprises one or more changes to one or more files in the codebase;

determining an application type of the codebase,

wherein the application type is associated with a set of known security vulnerabilities, and

wherein the application type is determined based on at least one of: a file type of the one or more files in the codebase, a programming language used in the one or more files in the codebase, a code dependency used by the one or more files in the codebase, or a user who made one or more changes included in the proposed change to the codebase;

determining a code context for the proposed change, wherein the code context includes the application type associated with the set of known security vulnerabilities;

generating, by a plurality of code analyzers, sets of code segments,

wherein each code segment contains text from the proposed change,

wherein each of the plurality of code analyzers is configured to generate a corresponding set of code segments; and

detecting a security vulnerability in the proposed change by using the plurality of code analyzers to analyze corresponding sets of code segments in parallel.

16 . The computer-implemented method of claim 15 , wherein each of the plurality of code analyzers are configured to:

identify, based on the code context, assistance data; and

process, using a large language model, the assistance data and a corresponding set of code segments.

17 . The computer-implemented method of claim 15 , further comprising:

identifying a natural-language security question,

wherein the natural-language security question is associated with a particular security vulnerability; and

detecting, at least in part by processing the natural-language security question using a code analyzer, a security vulnerability in the proposed change.

18 . The computer-implemented method of claim 15 , further comprising:

detecting a second security vulnerability in a second proposed change to a second codebase; and

generating a summary based on the security vulnerability detected in the codebase and on the second security vulnerability detected in the second codebase.

19 . The computer-implemented method of claim 15 , further comprising:

determining, based at least in part on the code context, that a portion of text in the proposed change corresponds to executable instructions; and

including the portion of text in at least one code segment.

20 . At least one non-transitory, computer-readable storage medium comprising instructions recorded thereon, wherein the instructions, when executed by at least one data processor of a system, cause the system to:

receive a proposed change for a codebase comprising a collection of files including text written in one or more programming languages,

wherein the proposed change comprises one or more changes to one or more files in the codebase;

receive a code context for the proposed change,

wherein a code context is determined based on at least a file type of the one or more files or a programming language used in the one or more files,

wherein the code context corresponds to an application type of the codebase that is associated with a set of known security vulnerabilities;

split the proposed change into a set of code segments according to the set of known security vulnerabilities that corresponds to the code context; and

providing, to one or more Large Language Models (LLMs), one or more prompts corresponding to the set of known security vulnerabilities;

supplying, based on a set of initial responses from the one or more LLMs, assistance data for the set of code segments,

wherein the assistance data comprises at least one of: a known vulnerable coding pattern for the set of code segments, or a set of known edge scenarios representing extreme values within a range of possible values; and

determining whether a security vulnerability exists based on a set of updated responses from the one or more LLMs.

21 . The at least one non-transitory computer-readable storage medium of claim 20 , wherein receiving the code context comprises generating the code context by processing the proposed change using an LLM.

22 . The at least one non-transitory computer-readable storage medium of claim 20 , wherein determining whether a security vulnerability exists in the proposed change further comprises:

supplying the one or more LLMs with one or more one-shot or few-shot prompting examples,

wherein the one or more examples are determined based at least in part on the code context.