Prerequisites
Review system, environment, and scanner requirements before using the IBM Bob Premium Package for DevSecOps.
Review these requirements before you start using the DevSecOps package.
System requirements
| Requirement | Details |
|---|---|
| IBM Bob | Version 2.2.2 or later, installed and authenticated. |
| DevSecOps package | Active license for the IBM Bob Premium Package for DevSecOps. |
| Operating system | macOS, Linux, or Windows. |
Scanners
The DevSecOps package uses the following scanners. They run on the IBM server side: the extension sends relevant code to the Bob backend for analysis. IBM manages scanner versions automatically; no separate installation is required.
| Scanner | What it scans |
|---|---|
| Trivy | Vulnerabilities in container images, file systems, and Git repositories; exposed secrets and credentials. |
| Opengrep with Bob rules | Security anti-patterns and code-quality issues detected using the Opengrep engine with IBM-curated rules. |
| KICS (Keeping Infrastructure as Code Secure) | Misconfigurations in infrastructure-as-code files, including Terraform, Kubernetes, Docker, and Ansible. |
SAST languages and IaC file types
The following languages and file types are scanned for vulnerabilities and misconfigurations.
Programming languages
| Language | File extensions |
|---|---|
| JavaScript / TypeScript | .js, .jsx, .mjs, .cjs, .ts, .tsx, .mts, .cts |
| Python | .py, .pyw |
| Java | .java |
| Go | .go |
| C / C++ | .c, .h, .cc, .cpp, .cxx, .hh, .hpp, .hxx |
| PHP | .php, .phtml |
| Ruby | .rb, .rbw |
Infrastructure as code and configuration
| Type | Files |
|---|---|
| Terraform / OpenTofu | .tf, .tfvars |
| Kubernetes and Helm | .yaml, .yml |
| Docker and containers | Dockerfile, Containerfile |
| Ansible | .yaml, .yml playbooks and roles |
| CloudFormation / AWS SAM | .json, .yaml |
| ARM / Bicep | .bicep, .json |
| CI/CD pipelines | GitHub Actions and GitLab CI configuration files |
Supply chain scanning ecosystems
Supply chain scanning parses package manifests in the following ecosystems:
| Ecosystem | Manifest files | Package managers |
|---|---|---|
| JavaScript / TypeScript | package.json | npm, yarn, pnpm, bun |
| Python | requirements.txt, pyproject.toml, Pipfile, Pipfile.lock, uv.lock, poetry.lock | pip, Poetry, uv, Pipenv |
| Java | pom.xml, build.gradle, build.gradle.kts, gradle.lockfile | Maven, Gradle |
Overview
Extend IBM Bob with security scanning capabilities that surface vulnerabilities, misconfigurations, exposed secrets, and supply chain risks directly in your IDE.
Getting started
Learn how to view findings, fix issues, use SafeWrite, and work with the Security dashboard in the IBM Bob Premium Package for DevSecOps.