--- metadata: - name: generator content: Diplodoc Platform v5.59.0 alternate: - https://sourcecraft.dev/portal/docs/en/sourcecraft/articles.md - https://sourcecraft.dev/portal/docs/ru/sourcecraft/articles.md - href: https://sourcecraft.dev/portal/docs/en/sourcecraft/articles.md type: text/markdown title: Markdown version - href: https://sourcecraft.dev/portal/docs/en/llms.txt rel: describedby title: Articles on SourceCraft description: Articles and publications on SourceCraft. --- > **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt # Articles on SourceCraft Articles where experts from SourceCraft, Yandex Cloud, Yandex Infrastructure, and other teams cover details of SourceCraft implementation and share their development-related insights and plans going forward. {% list tabs group=years %} - 2026 {#2026} * [What fears prevent developers from switching to Cloud IDE and how we were addressing them architecturally](#cloud-ide-spaces) * [AI-powered SAST: How LLMs detect vulnerabilities and where they fail](#ai-powered-sast) * [Two months instead of a year: How we migrated 97,000 lines of Objective-C to Swift](#objective-c-swift) * [The team lead’s guide to pain-free releases: Building a predictable process from simple practices](#releases-with-no-pain) * [Top web hacking techniques: How developers can defend against non-obvious vulnerabilities](#top-attacks) * [What is cURL and how to use it](#curl) * [Linux Bash basics: Writing your first Bash script](#bash-first-script) * [Code search: Why simply indexing every commit is a bad idea](#code-search) * [The developer’s guide to choosing the right IDE](#choose-ide) - 2025 {#2025} * [Under the hood of pull requests: Our effort to accelerate code indexing for easy navigation during review](#accelerate-indexing) * [SourceCraft + Habr = ❤️](#sourcecraft-habr) * [How to work with custom security analyzers in CI](#custom-analyzers) * [Artificial intelligence in the works: exploring trends and practical applications](#ai-in-dev-trends) * [Secret ingredients for secure development: Achieving precise and fast secret detection](#secret-ingredients-security) * [Dogfooding, AI assistants, and code navigation: Exploring SourceCraft, a new development platform by Yandex](#sourcecraft-interesting-news) - 2024 {#2024} * [Solving the challenge of instant code navigation for any commit](#instant-code-navigation) * [AI tool for developers: How we were training LLMs to work with code](#how-we-trained-llm) {% endlist %} ## 2026 {#2026} ### What fears prevent developers from switching to Cloud IDE and how we were addressing them architecturally {#cloud-ide-spaces} For a cloud IDE to become a full-value development environment, you need a quick start, user isolation, state persistence, and convenient development tools. In his new article, SourceCraft lead developer Sergey Babenko discusses how the team went about designing the SourceCraft Spaces cloud development environments and the decisions that had to be made to create a cloud IDE: * Why did we choose virtual machines over containers? * What is the mechanism behind the quick launch of workspaces? * How did we go about authorization and security? * What AI agents scenarios are we considering when developing our platform? [Habr article](https://habr.com/ru/companies/sourcecraft/articles/1048918/) ### AI-powered SAST: How LLMs detect vulnerabilities and where they fail {#ai-powered-sast} Traditional SAST tools are prone to excessive noise. Triaging these false positives often takes more time than fixing actual security threats. To keep teams from drowning under a flood of alerts, modern static analysis platforms are increasingly enhanced with LLMs. In his new article, Denis Makrushin examines how LLMs transform code analysis, and what actually takes place when you click **Triage with AI**. [Habr article](https://habr.com/ru/companies/sourcecraft/articles/1038016/) ### Two months instead of a year: How we migrated 97,000 lines of Objective-C to Swift {#objective-c-swift} Over five years of manual migration, we had managed to rewrite just over half of our legacy codebase. LLM-based automation changed everything, as now we relied on it to: * Analyze the dependency graph to start migration from leaf modules, i.e., those with no dependencies on legacy code. * Rewrite code while continuously validating it through builds and tests. * Refactor code according to Swift best practices. * Automatically check quality against a predefined checklist before code review. The results speak for themselves: instead of the estimated year, the team rewrote 97,500 lines of code, migrated 2,167 files, and merged 106 pull requests in just two months. All prompts, configuration templates, and helper scripts are available [in our public SourceCraft repository](https://sourcecraft.dev/yandex/migration-toolkit-for-swift). Feel free to tailor and use them in your projects. [Habr article](https://habr.com/ru/companies/yandex/articles/1028494/) ### The team lead’s guide to pain-free releases: Building a predictable process from simple practices {#releases-with-no-pain} We use real-world examples to break down the processes, rules, and tools that help teams release updates smoothly, without late-night emergencies. [SourceCraft blog article](https://sourcecraft.dev/portal/blog/ru/releases-with-no-pain) ### Top web hacking techniques: How developers can defend against non-obvious vulnerabilities {#top-attacks} Denis Makrushin from our secure development team looks at top hacking techniques and ways to mitigate non-obvious vulnerabilities. Beyond errors in code, modern attacks increasingly exploit discrepancies between system components. The focus is shifting toward infrastructure and protocols, meaning security must be considered at the system level, not just within individual components. The top most common attacks include: * Inconsistent interpretation: Divergent handling of data formats (JSON, YAML, HTTP) and Unicode normalization is a leading cause of input filter bypasses and remote code execution. * Protocol quirks: Arbitrary requests in HTTP/2 can be weaponized for network reconnaissance, and a new SSRF technique exploits redirect anomalies. * Prompt injection into AI agents: Malicious instructions hidden in commits or tickets trick agents into executing privileged commands during build pipelines. * Zip Slip reborn: Exploring the comeback of a known vulnerability in new contexts. Denis shares actionable recommendations on how to remediate these issues during development, long before they turn into incidents. [Habr article](https://habr.com/ru/companies/sourcecraft/articles/1026090/) ### What is cURL and how to use it {#curl} A guide to installing and running cURL, covering basic syntax, essential commands, and key options. Find examples for GET and POST requests, file downloads, authentication, header manipulation, and redirect handling. Learn how to use cURL for API testing and task automation. [SourceCraft blog article](https://sourcecraft.dev/portal/blog/ru/curl) ### Linux Bash basics: Writing your first Bash script {#bash-first-script} An introduction to Bash, its syntax, and basic commands. Learn how to choose an editor, create and run your first Bash script, use variables, arguments, conditionals, and loops through beginner-friendly examples and tips. [SourceCraft blog article](https://sourcecraft.dev/portal/blog/ru/bash-linux) ### Code search: Why simply indexing every commit is a bad idea {#code-search} How do you implement fast code search for any commit? At first glance, indexing every commit seems reasonable. However, in large repositories, this quickly leads to gigabytes of indexes and long indexing times. Vladimir Bobrov walks through approaches tested in SourceCraft, from naive full indexing to delta snapshots and persistent trees, and explains how we ultimately adopted a history linearization strategy. The full story, including why this approach delivers fast search and predictable response times even in massive repositories, is available in our Habr blog post. [Habr article](https://habr.com/ru/companies/sourcecraft/articles/1021852/) ### The developer’s guide to choosing the right IDE {#choose-ide} A curated list of IDEs for Java, Python, JavaScript, C++, and other programming languages. [SourceCraft blog article](https://sourcecraft.dev/portal/blog/ru/ide-for-programmer) ## 2025 {#2025} ### Under the hood of pull requests: Our effort to accelerate code indexing for easy navigation during review {#accelerate-indexing} Reviewing a large pull request is like a tour without a guide: it is hard to see the connections between scattered fragments just by looking at the text changes. The situation changes as new tools emerge able to build a semantic code model directly in the cloud. Smart navigation will help you sort out pull requests of any complexity, allowing you to quickly jump to the definition and search for usages. In his new article on Habr, Pavel Talanov from the Yandex Infrastructure team tells the story of how we were building this functionality and tackled this challenge at the junction of backend and IDE:  * Why the IDE index proved not suitable, and what it looks like for each new commit on the platform. * The mechanism behind the tooltips. * Our approach to symbol binding. * The architecture of smart code navigation. * How we measured the solution’s quality. [Habr article](https://habr.com/ru/companies/yandex_cloud_and_infra/articles/976172/) ### SourceCraft + Habr = ❤️ {#sourcecraft-habr} We all love reading stories and exploring new technologies on Habr. Many Habr articles contain examples of code. But what if the code is hard to figure out? Now you can have any code snippet on Habr explained with just one click using **Explain code with SourceCraft**. For more complex tasks, a second click will take you to SourceCraft: the context is preserved, and you can rewrite the code in another language, run an error check, or test the code directly on the platform. For more on how we did it, read the Habr article. [Habr article](https://habr.com/ru/companies/habr/articles/973170/) ### How to work with custom security analyzers in CI {#custom-analyzers} Today, code security during development is prioritized by every team. Learn how to configure SourceCraft for it not just to help you write code but also to scan it for vulnerabilities and misconfigurations. We instruct you how to hook up code analyzers and linters and integrate scan results directly into your pull request. * [Blog article](https://sourcecraft.dev/portal/blog/ru/release-v2025-10) * [Guide](https://sourcecraft.dev/portal/docs/en/sourcecraft/tutorials/custom-security-analyzers.md) ### Artificial intelligence in the works: exploring trends and practical applications {#ai-in-dev-trends} How do development tools transform the workflows: from classrooms to product teams? Dmitry Ivanov, Head of SourceCraft, shared the results of the study in his article on Habr. The article covers: * Mass implementation of AI assistants in development. * Transformation of labor market and requirements for developers. * Impact on productivity of development teams. * Willingness to invest into new technologies. * Education of a new generation of developers. [Habr article](https://habr.com/ru/companies/yandex_cloud_and_infra/articles/947526/) ### Secret ingredients for secure development: Achieving precise and fast secret detection {#secret-ingredients-security} Code serves as one of the primary repositories for various secrets. A single commit can accidentally expose a token or password to the public. Identifying secrets becomes a real challenge when one needs to scan all projects hosted on a popular developer platform. Our secure development experts, Denis Makrushin, Andrey Kuleshov, and Alexey Troynikov, explained how the secret detection feature is implemented, highlighting the key criteria for secret scanning: it has to be fast, precise, and thorough. The article covers: * Case study analysis. * Comparison of two modern and high-speed secret-scanning tools: Kingfisher and Gitleaks. * Review of benefits LLMs have over traditional methods, i.e., entropy analysis, regular expressions, and signatures. [Habr article](https://habr.com/ru/companies/yandex_cloud_and_infra/articles/929558/) ### Dogfooding, AI assistants, and code navigation: Exploring SourceCraft, a new development platform by Yandex {#sourcecraft-interesting-news} The story of SourceCraft began in Yandex Infrastructure, a team focused on building tools for creating and deploying internal Yandex applications and services and supporting the infrastructure utilized by most of the company's engineers. In many ways, this is the reason why many ideas for the new platform sprang into existence thanks to dogfooding, i.e., the team of creators using their own product. Join SourceCraft developers Olga Lukyanova and Sergey Zakharchenko to learn what it is like to be crafting a development platform while at the same time using the same platform to write code, run tests, review pull requests, build and deploy the software. [Habr article](https://habr.com/ru/companies/yandex_cloud_and_infra/articles/885788/) ## 2024 {#2024} ### Solving the challenge of instant code navigation for any commit {#instant-code-navigation} SourceCraft developer Olga Lukyanova speaks about the beginnings of code navigation in SourceCraft and why it was essential not to turn the platform into an IDE. [Habr article](https://habr.com/ru/companies/yandex_cloud_and_infra/articles/863500/) ### AI tool for developers: How we were training LLMs to work with code {#how-we-trained-llm} Viktor Ploshikhin, head of ML laboratory at Yandex Platform Engineering, gave an account of his team's effort to build an AI assistant for developers. How models were fine-tuned on real code; the "whys" behind the choice to predict statements; what metrics and methods they developed for quality assessment. What you will learn: * What problems are addressed by the developers and what LLMs do to help. * What modern AI assistants are capable of. * Commonly used methods to evaluate the benefits of AI products. * AI's impact on business. [Habr article](https://habr.com/ru/companies/yandex/articles/841436/) [Watch on YouTube](https://www.youtube.com/watch?v=wlleBQFa0Zc) #### Useful links {#see-also} * [Videos about SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/public-talks.md) * [SourceCraft release notes](https://sourcecraft.dev/portal/docs/en/sourcecraft/release-notes.md)