Getting started
Learn how to view findings, fix issues, use SafeWrite, and work with the Security dashboard in the IBM Bob Premium Package for DevSecOps.
Before you start, ensure your environment meets all requirements. For more information, see Prerequisites.
The DevSecOps premium package runs scanning continuously as you work. Findings appear in the Bob Findings panel as they are detected. You can also trigger a scan on demand: open the command palette and run IBM Premium Package for DevSecOps: Scan for issues or IBM Premium Package for DevSecOps: Run Supply Chain Scan. The Scan for issues command runs the code and config scan (SAST, IaC, secrets) and the supply chain scan together.
To divide a large repository into smaller chunks, right-click any directory and select IBM Bob Premium Package for DevSecOps > Scan.
Viewing findings
The Bob Findings panel consolidates all active scan results for your workspace in one place.
Open your IDE with a project loaded.
Open the Bob Findings panel in the Bob side panel.
Review the findings list. Each finding shows:
- Severity: Critical, High, Medium, Low, or Info.
- File and line: the exact location in your code.
- Rule ID: the scanner rule that triggered the finding.
- Description: a plain-language explanation of the issue.
- CVSS score (where available): the severity score from the CVE database.
- Recommended safe version (supply chain findings): the nearest version without the vulnerability.
- Remediation guidance (where available): suggested steps to resolve the issue.
Fixing a finding
The Fix with Bob button starts an agentic task that analyzes the finding in context and applies a fix.
In the Bob Findings panel, select the finding you want to resolve.
Click Fix with Bob.
Bob opens a new task in the chat panel and begins analyzing the issue. Review Bob's proposed changes before you accept them.
After you accept the changes, verify that the finding is no longer present in the Bob Findings panel.
SafeWrite
SafeWrite protects your codebase from AI-generated security vulnerabilities. When Bob runs an agentic task that writes or edits files, SafeWrite intercepts the proposed changes in memory before they are written to disk.
If the agent attempts to declare a known vulnerable dependency, SafeWrite automatically replaces it with the nearest secure version before the write completes. If the agent attempts to install a vulnerable package through a CLI command such as npm install or pip install, SafeWrite blocks or patches the command.
SafeWrite also prevents direct tampering with lockfiles (package-lock.json, poetry.lock, and similar files), and can optionally run SAST checks against proposed code changes before they are written.
SafeWrite (experimental) is turned off by default. To use it, enable SafeWrite in the extension settings.
Security dashboard
The Security dashboard provides a real-time and historical view of scan results across your project. Open it from the Bob side panel to see scan runs organized by project and branch, track trends over time, and review or dismiss findings from past runs. You can select multiple findings for bulk remediation, and export a standalone HTML report of your results.
The dashboard stores results for up to 90 days.
Supply chain scanning
The DevSecOps package scans your dependency manifests for known vulnerabilities when you open or save a file. Supply chain findings appear in the Bob Findings panel alongside other findings. To remediate dependency vulnerabilities across your whole project at once, use the Fix Supply Chain Vulnerabilities workflow. For more information, see Fix supply chain vulnerabilities workflow.
Agent install policy
When Bob installs a package during an agentic task, the DevSecOps package checks the dependency before the install completes. If the package is flagged as risky:
- Bob does not silently install the package.
- Bob reports the risk information in the chat and installs the recommended version instead.