AI-powered vulnerability analysis and prioritization in SourceCraft

For issues detected in the course of static application security testing, there is triage, i.e, AI-generated tips with risk and criticality assessment, false positive probability analysis, and possible fixes.

For issues detected through scanning of secrets and static application security testing, you can perform triage, i.e., bulk AI-powered alert severity assessment.

Tip

Using this feature consumes neurocredits. Check your balance and usage history on the Code Assistant statistics page.

Vulnerability analysis

To run AI-powered analysis of a specific vulnerability, follow these steps:

Open the SourceCraft home page.
On the Home tab, navigate to Repositories and select a repository.
Under Security on the repository page, go to Code scanning.

Note

Similarly, you can view a general list of issues for all repositories in the organization.
Select the issue you want to run AI-powered vulnerability analysis for.
In the top-right corner, click Triage with AI.

Wait for SourceCraft Security Bot's comment to appear.

Vulnerability prioritization

To run AI-powered prioritization for a group of alerts, follow these steps:

Open the SourceCraft home page.
On the Home tab, navigate to Repositories and select a repository.
Navigate to one of these sections on the repository page under Security:
- Secret scanning: List of detected secrets.
- Code scanning: List of SAST issues.
In the top-right corner, click Triage with AI.
In the window that opens, in the Minimum severity field, select the minimum alert severity level for the AI to initiate triage: Critical, High, Medium, or Low. Only alerts with this severity or higher will be triaged.
Click Triage alerts.

Once prioritization is complete, an additional icon displaying the AI-estimated severity rating will appear next to each triaged alert in the list.

Useful links

Was the article helpful?

Generating a description for a pull request

Using AI skills