Overview
Extend IBM Bob with security scanning capabilities that surface vulnerabilities, misconfigurations, exposed secrets, and supply chain risks directly in your IDE.
The IBM Bob Premium Package for DevSecOps adds continuous security scanning, AI-driven vulnerability analysis, and automated remediation to your development workflow. Findings surface directly in your IDE as you work.
What's included
Vulnerability, misconfiguration & secret scanning
Detect vulnerabilities and misconfigurations in your code and infrastructure-as-code files using Trivy, Opengrep with Bob rules, and KICS.
Identify exposed secrets, tokens, and credentials before they reach version control.
Supply chain risk analysis & remediation
Scan dependency manifests for known CVEs, package popularity signals, and release age on every file open and save. Risky packages are also blocked at install time during agentic tasks.
Remediate dependency vulnerabilities across your entire project with automated test-suite validation at each step.
SafeWrite
Intercepts AI agent file writes in memory and automatically patches vulnerable dependency declarations before they reach your codebase.
AI-driven security scans
Run an attack surface scan or a file sweep scan to find vulnerabilities using AI reasoning rather than fixed rules.
IaC Automation Skills
Native Bob skills registered by the extension providing deep, guided infrastructure-as-code expertise across Ansible and Terraform.
Fix with Bob
Start an agentic task directly from a finding. Bob analyzes and resolves the issue in the same IDE window.
Security dashboard
View historical scan results organized by project and branch, track trends, and dismiss findings from past runs.
How it works
Rule-based scanning runs continuously as you write and edit code. Findings appear in the Bob Findings panel immediately, showing severity, file, line, rule ID, and remediation guidance where available. You can select any finding and start an agentic fix without leaving your current context.
For deeper analysis, the package includes AI-driven scan workflows that reason about your project's architecture and data flows to find vulnerabilities that rule-based scanners miss.
Getting started
Review prerequisites
Ensure your environment meets all requirements before activating the package.
For more information, see Prerequisites.
View findings
Open the Bob Findings panel to see active scan results across your workspace.
For more information, see Viewing findings.
Fix a finding
Select any finding and click Fix with Bob to start an agentic task that analyzes and resolves the issue.
For more information, see Fixing a finding.
Run a workflow or skill
Use the Fix Supply Chain Vulnerabilities workflow to remediate dependency vulnerabilities across your project, or run an AI-driven security scan.
For more information, see Workflows and skills.