Full transcript
0:07Hey everyone, thank you for joining us
0:09for the next session of our spotlight on
0:11GitHub advanced security series. My name
0:14is Anna. I'll be your producer for this
0:16session. I'm an event planner for
0:18Reactor joining you from Redmond,
0:20Washington.
0:22Before we start, I do have some quick
0:24housekeeping.
0:26Please take a moment to read our code of
0:27conduct.
0:29We seek to provide a respectful
0:30environment for both our audience and
0:32presenters.
0:34While we absolutely encourage engagement
0:36in the chat, we ask that you please be
0:38mindful of your commentary. Remain
0:40professional and on topic.
0:42Keep an eye on that chat. We'll be
0:44dropping helpful links and checking for
0:46questions for our presenters to answer
0:48live.
0:49Our session is being recorded. It will
0:51be available to view right here on the
0:53Reactor channel.
0:55With that, I'd love to turn it over to
0:57our speakers for today. Thank you so
0:59much for joining.
1:03Welcome back everyone to another episode
1:06of the GitHub advanced security series.
1:08I'm your host Lupita Caravis and with me
1:10today I have a very special guest
1:12joining me from the product team to talk
1:15about our new code quality offering. But
1:17before we get to introductions, I'd like
1:19to set the stage on what to expect. For
1:22those of you who are new here, Reactor
1:24serves as a platform to provide ungated
1:27content to the community. I highly
1:29recommend folks to opt in to the GitHub
1:32notifications to be the first to find
1:33out about what's happening. This is a
1:36followup from a universe talk, so I
1:38always say this is me casually saying
1:41like and subscribe so you're the first
1:43to know. I actually started the series
1:46with one goal in mind to provide a space
1:48for collaboration especially in this new
1:52era of AI where there's just no room for
1:55compromise and I always say our
1:57competition isn't each other it's the
2:00forces beyond our understanding so
2:03GitHub has always stood to accelerate
2:05the human progress and so our mission is
2:07to help develop the most secure high
2:09quality code possible I'm an enterprise
2:12application security executive here at
2:14GitHub. I've been with GitHub for about
2:163 years and I always like to give a
2:18little bit of insight on my background
2:20so you understand where my perspective's
2:21coming from. But essentially what my
2:24role means is I serve as an ally to the
2:26community to help guide organizations on
2:29their security and code quality journey.
2:32I've been in the space for about 10
2:34years and I actually look back to when I
2:37was a developer like fresh out of
2:38college and I think oh because I had a
2:414.0 know I had it all figured out in
2:44compsai. Um, little did I know I was in
2:47for a rude awakening, right? Classroom
2:49code does not translate to
2:52enterprisegrade scalable programming.
2:54And so I I I remember like looking back
2:57at my code and thinking like who wrote
3:00this? And then I realized it was me. I
3:03did. So I can't even imagine what it's
3:05like nowadays where developers don't
3:08really internalize the outputs of their
3:10inputs. or maybe some do, but like I
3:13think the importance of having automated
3:15code quality scanning is key alongside
3:18with security. And I know you might be
3:20thinking, okay, well, there's like a ton
3:22of solutions already out there that do
3:24this. Um, but I think our goal is to be
3:26like the one-stop shop, right? To be the
3:29single pane of glass that has it all.
3:31Um, I always say like for example, we
3:33have multiple streaming services as
3:35personal users, right? Different
3:37interests, different needs and so on. So
3:41what we aim to do today is to guide you
3:43through our philosophy and approach to
3:45how we're tackling this code quality
3:47problem. As we know, quality can mean
3:50different things to different people. So
3:53I invite you to keep an open mind. Um
3:55with that, I'm going to go off camera so
3:58I can monitor the chat for any
3:59questions, comments. You know, we like
4:00to make this as interactive as possible
4:02and hand it over to Harrow to take the
4:05stage and walk us through what we're
4:07doing at GitHub.
4:12Hi everybody. My name is Carol. I'm a
4:15product manager here at GitHub and I am
4:18leading our new code quality initiative.
4:22I've been with GitHub for about three
4:25years now and I'm really excited for
4:27this new product and I'm going to talk a
4:30lot about it and show you a demo of it
4:31today.
4:33So, let's get into it. These are the
4:36topics that I'm going to hit on
4:38throughout. Uh I'm going to set a little
4:41bit of context about code quality and
4:44what it means in an AIdriven world, how
4:46we're thinking about it at GitHub. I'm
4:48going to give you a demo of the public
4:51preview for our new GitHub code quality
4:53product. Talk a little bit about the
4:55road map. And then at the end, we'll
4:57have some time for uh Lupita and I to
5:00answer some of your questions that come
5:02up in the chat.
5:06So, it's no secret that AI has truly
5:10turbocharged software development.
5:12Suddenly, features that took quarters
5:15can take days or fewer to generate. It's
5:18the age of every engineer becoming a 10x
5:20engineer. The speed of this code
5:23generation is putting strain on our
5:25traditional systems and really showing
5:27where our scale is failing.
5:31There's this saying, slow is smooth and
5:35smooth is fast. When it comes to racing
5:38or software development, the
5:40counterintuitive truth is that speed and
5:43control actually go hand in hand. Simply
5:46pumping the gas or throwing AI at your
5:49code is really great for fast
5:52straightaways, but as soon as you hit a
5:55turn, you're going to crash out. In
5:57development, those turns are where
6:00quality, safety, and control are put to
6:03the test, and that's via things like
6:05code reviews and quality or security
6:08gates.
6:12But it's a trade-off. If you focus too
6:15much on the speed, you get technical
6:17debt, bugs, and ultimately lost trust
6:21and revenue. But if you hit the brakes
6:24too hard, the reviews become slow, your
6:28developers workflows are disrupted, and
6:31you lose the advantage from the speed
6:33that you get with AI.
6:35This is a really easy trap to fall into,
6:38especially when your tools are not ready
6:40to support the new world of AI
6:41development.
6:45And I, as a representative of the
6:47developer tools company GitHub, have a
6:50solution for you. Here at GitHub, we
6:53believe that all code, whether it's
6:55written by humans or with the help of
6:59AI, should be secure and high quality by
7:03default. Not as a trade-off to juggle,
7:07but as a natural outcome of how you
7:09build your software. Quality shouldn't
7:12be something that you bolt in at the end
7:14of your process in a different browser
7:17tab in a different login.
7:20We're building it directly into the
7:22platform at every point in the developer
7:24experience.
7:27Our new product, GitHub code quality,
7:30provides that built-in platform quality
7:33experience so that every repository,
7:36every team, and every line of code meets
7:39the highest standard.
7:43I'm excited to show you a live demo, but
7:46as a former developer myself, first I
7:49have to pontificate a little bit on the
7:52meaning of quality.
7:54When we first wanted to start building
7:57this at GitHub, we posed this question
8:00to all of the internal developers. What
8:03does it mean to have highquality code?
8:06And I've been in this industry for over
8:0910 years now, and even I was surprised
8:11by the intensity of some of the
8:13responses.
8:15The truth is that at the end of the day,
8:18quality is super important to everybody,
8:21but there's no one formula to say, well,
8:23this code is high quality and this code
8:26is not high quality.
8:30It turns out to nobody's surprise that
8:32the meaning of quality is highly
8:35contextual.
8:36A 50-year-old medical devices company
8:39maintaining a legacy C++ codebase is
8:43going to have a very diff different
8:45definition of quality from a 10person AI
8:48developer tools startup.
8:54For the sake of being able to develop a
8:56product and not just a manifesto about
8:59quality, we landed on a couple key
9:01categories that kept coming up in our
9:04conversations internally and with
9:06trusted design partners.
9:08Maintainability.
9:10How easy is it to change and add to this
9:13code over weeks or months or years?
9:17Reliability. How likely is it that this
9:20code is going to crash and page me in
9:22the middle of the night?
9:24test coverage. How confident am I that
9:26this code is doing what I think it's
9:28doing? And there's this kind of new area
9:32that's a little bit more nebulous that
9:34we're still working to figure out, which
9:37is along the lines of how good are my AI
9:41agents at producing what I am asking
9:43them to produce.
9:48Our public preview of GitHub code
9:50quality gives you repository level
9:53summaries of maintainability and
9:56reliability and we have test coverage
9:59and other AI stuff coming later on our
10:01road map. Our quality findings are
10:04calculated using a mix of deterministic
10:07static analysis and LLM power detection
10:11which brings you the best of both worlds
10:13for a more cohesive quality summary.
10:17And I wouldn't be able to call myself a
10:19GitHub product manager if I did not call
10:21out that we have our world-class
10:23co-pilot to generate fixes for anything
10:27that we find in the quality tool. When
10:30you're with GitHub, whether it's for
10:32security or quality, found means fixed.
10:38So now I'm going to switch to my live
10:40demo. I'm done. I'm getting off my soap
10:43box about quality and I'm going to show
10:45you what we actually have live in the
10:46product today.
10:49I just need to make sure that my
10:51monitors are sharing the right thing.
10:55Which one do I want? Not that one. Not
10:58that one. This one. This is where we're
10:59starting.
11:01So suppose that I'm a developer. Going
11:05to dust off my developer hat. I'm going
11:07to jump into some coding
11:09here. I'm pretending that I'm working at
11:12this
11:14uh company that makes an analytics app
11:16for F1 racing. My company's called Rev
11:19Litics. In this app, we're surfacing
11:22real-time stats for drivers so that F1
11:24teams can track pace, plan pit stops,
11:28that kind of thing. Maintaining uptime
11:30and stability for our app is very
11:32important to us. If we have downtime in
11:35the middle of a race, we're going to
11:36lose a lot of customer trust and it is
11:38not going to be good for our business.
11:42This feature that I'm making is a panel
11:44in a web app where we estimate a
11:46selected driver's fuel usage and then
11:49that way we can give an estimate for
11:51when they might need to refuel which is
11:53going to impact their pace.
11:56So if I look down at here, I can see
12:01that the code quality bot has found a
12:04couple problems.
12:06Here is an example where I am trying to
12:10in JavaScript use uh the keyword this
12:14and calling it to something before I've
12:16actually called it super constructor,
12:18which is an error and is probably going
12:20to make my app crash. Clearly, I wrote
12:23this code before I drank my coffee.
12:26In one click, it's already given me the
12:29suggested fix for it right in line. I
12:32can commit the suggestion directly to
12:35my pull request.
12:41From there, it's going to rerun based on
12:45the commit that I just made.
12:49It's going to check if there are any
12:50others that are left. I can see that
12:52there are some other errors that it
12:54found as well. And if I scroll all the
12:56way down, I can see that it's it's
12:59blocked right now because my
13:00administrator has set up a rule set
13:04where I can't merge this pull request uh
13:07unless I have a code quality result set
13:12and that it doesn't contain any errors
13:15or warnings from code quality.
13:19In this way, I can make sure that the
13:22code that is newly being added to my
13:24codebase meets the quality bar that my
13:28company is going for.
13:31Now that we've maintained the bar of
13:32quality for the new code, though, we
13:35want to check out what are all of the
13:37existing quality problems that might be
13:39causing us headaches.
13:41And for this
13:44I can go over to my code quality tab
13:48which is currently under our security
13:50tab with our security tools. We have two
13:53different pages for code quality. The
13:55first one is this AI findings page. Here
14:00the LLM has scanned all of the files
14:04that I have most recently changed within
14:07the repository and it's giving me
14:10recommendations for those entire files.
14:13That way developers can check out all of
14:16the existing quality debt that might
14:19exist within the files that they're
14:22already working on so they can minimize
14:24context switching.
14:26Today, it can scan just the most recent
14:29pushes to the repository. In the future,
14:32we're hoping to expand it to scan entire
14:34repositories. The LLMs can't quite do
14:37that yet.
14:39So, if I look at this example
14:43in this file, I can see that the LLM has
14:46highlighted three potential problems and
14:50suggested some changes.
14:52I love that this first one is about
14:54inconsistent indentation. It turns out
14:56that LLMs care about tabs versus spaces
15:00maybe as much as some developers do.
15:03Once I've reviewed these changes,
15:06if I like them, I can either open a pull
15:09request with the direct diff as it's
15:11presented to me here, or I can assign it
15:14to copilot because I have a copilot
15:15license. in doing so is going to have
15:18copilot coding agent take all of these
15:21changes, apply them within a pull
15:23request and start iterating on them if
15:26it's finding that my build is failing or
15:28that other security problems or things
15:31are being surfaced.
15:35So I'm going to go ahead and assign
15:37those to copilot
15:40unable to create PR. I swear this demo
15:43is doomed.
15:44I tried this demo on the universe stage
15:47and this is exactly what happened as
15:49well. So that's how you know it's real,
15:52right?
15:54Next up, I'm going to go and I'm going
15:56to look at our standard findings page.
15:59Oops, I don't have to do that yet. This
16:01is the standard findings page. I can
16:03just click on it. Here I can see all of
16:06the findings that are coming from our
16:08deterministic code scanner tool. Here I
16:13get a maintainability score and a
16:15reliability score which are based on the
16:17number and severity of each of the
16:19findings that it has surfaced across my
16:23files. Here all of the findings are
16:26grouped by their rule. So each of these
16:29titles is a summary of what the problem
16:31is. All of our code quality related code
16:36rules have been tagged with either
16:38reliability or maintainability. So, we
16:41have them spread over these two
16:43categories and they all have a severity
16:45of note, warning, or error.
16:49When I'm first looking at this page,
16:52it's a little bit disappointing. I see
16:53that m maintainability is like kind of
16:55okay, but my reliability needs
16:58improvement which is a big problem for
17:02my company because as I said reliability
17:04is very important to us in maintaining
17:06that uptime particularly during races or
17:11other important periods.
17:14So since my reliability needs
17:16improvement, I want to look at the
17:18findings that are going to be affecting
17:20this score. With these filters, I can
17:23filter down to reliability and then I
17:26can filter down to the highest severity,
17:29which tells me that I have two instances
17:31of assignment to to constant which are
17:34causing my reliability score to tank.
17:39So when I go here, I can see more
17:41details about this problem and what
17:44might be happening, examples of the
17:46problem and what I should be doing
17:48instead.
17:50And then I have the findings themselves.
17:52In this case, I can see that they are
17:55both in the same file. If I had other
17:58ones across multiple files, I would see
18:00all of the files here. And I can see
18:03that copilot has suggested a change for
18:05me where simply instead of having this
18:08const I have a let which gives me a
18:12actual variable variable. From here I
18:15can open a pull request which will fix
18:18each of these problems.
18:27All right.
18:29So, I'm going to do some demo magic and
18:32I'm going to skip ahead. Uh, cuz each
18:34step of this, you know, requires I need
18:36to open the pull request and then the
18:38pull request needs to be reviewed and I
18:40need the code quality scan and all of
18:42that which takes a couple minutes. Once
18:45I skip ahead and once I fix these
18:48problems,
18:50what I can see here is that my
18:52reliability score has now increased all
18:54the way up to good, which is quite the
18:57improvement.
18:59And if I were to filter back down to my
19:02reliability problems, I can see that I
19:04have 15 or so left that are uh in this
19:08case all under this one rule. So if I
19:11wanted to get my reliability score to be
19:13that excellent like 100%, I could choose
19:16to fix all of these as well.
19:21All right. And now I'm going back to my
19:25presentation. So that was it for the
19:27live demo
19:30section. [snorts]
19:34I said earlier stuff about like when we
19:37were when we were thinking about doing
19:38code quality when we were like asking
19:41people what quality means, but
19:43truthfully it's a little bit silly for
19:45me to pretend that it's this like brand
19:49new idea and we just thought of it. And
19:51have you all ever considered writing
19:54high quality code? Whoa. Yeah, that's
19:58ridiculous.
20:00At GitHub, we've always believed in
20:02giving developers the best tools to
20:04support them throughout the software
20:06development life cycle.
20:08This new code quality tool simply
20:11completes our coverage of the cycle from
20:13creating secure and highquality code
20:15with co-pilot coding agent in the IDE to
20:19reviewing AI and human written code
20:21together in the pull request with
20:23co-pilot code review and now through
20:26maintaining existing code. Together
20:28these tools deliver continuous quality
20:31from the first line of code to the
20:33entire software portfolio.
20:39Coming up on our road map in the first
20:41half of 2026,
20:43we have important features like orgle
20:46level dashboards, which is this. What
20:49we're looking at here is our design for
20:52one of the tabs on the org level
20:55dashboard. We will have org level
20:57enablement and configuration so that you
21:00can turn it on across many repositories
21:03at once.
21:04and everyone's favorite test coverage
21:07metrics. Those are some of the big
21:10features that we're that we have coming
21:11in the first half of 2026.
21:14And as always, you can expect continuous
21:17small improvements.
21:19Things like improving the general
21:22usability and appearance based on the
21:25feedback that we get from all of you.
21:30To wrap things up, let's recap what
21:33makes our code quality approach unique.
21:36First of all, it's all in GitHub, so
21:38developers never have to leave their
21:40flow.
21:41Second, we combine unified intelligence,
21:45LLMs, and deterministic code analysis
21:49working together for unmatched depth,
21:52consistency, and remediation.
21:54Finally, it scales effortlessly from
21:57individual repos to global enterprises.
22:00lowering your management complexity and
22:02reducing your total cost of ownership.
22:05This isn't about stitching tools
22:07together. It's about transforming how
22:10work gets done. Every insight feeds the
22:13next commit, creating a virtuous cycle
22:15where development and quality
22:17continually reinforce each other.
22:20You can enable this tool today in your
22:23repositories for free.
22:25In the future, it's going to be a paid
22:27product, but we're still working on
22:29those details. So, we don't have any
22:30information about billing at this time.
22:33But you can rest assured that it is free
22:37for now, and there will be a lot of
22:39notice before we transition to a paid
22:41product.
22:44So, thank you. That's the end of the
22:46formal presentation and demo. Uh and now
22:49Lupita and I can come on and answer any
22:52questions uh that have come up in the
22:54chat.
22:55>> Yeah. Awesome. Thank you, Carol, for
22:57guiding us through that. I can't stress
23:00enough how authentic these sessions are.
23:02This is live. It's not AI, [laughter]
23:05right? So, we're going to be human. Um
23:07speaking of human, I I could not relate
23:09more when you said
23:11writing code before coffee.
23:14>> Yeah. [laughter]
23:15[gasps]
23:16>> Yeah. So let let's go ahead and open up
23:18for questions. I do see a couple here.
23:20So let's start with the first one that I
23:22see. Will it tell the reason why that
23:25particular code is bad and why the
23:27recommended solution will solve that
23:30problem?
23:32Yes, every every finding and fix that we
23:36have both in the pull request and in the
23:39backlog comes with a little bit of an
23:41explanation of why it is suggesting that
23:45to be changed.
23:49>> All right. How does this new solution
23:52approach critical bugs like CVEes that
23:54are released
23:56>> with GitHub code quality? We don't
23:59address CVEes directly. That is actually
24:02taken care of in uh the rest of our
24:05suite of GitHub advanced security
24:07products uh like uh code security.
24:11>> Yeah. So that would be a part of the gas
24:14pillar.
24:14>> Yes.
24:16>> And then I see you mentioned,
24:18but can an individual developer
24:22[clears throat] do this on their own
24:23open source projects?
24:26Yes, you should be able today to turn it
24:29on for your uh individual repositories
24:33and it will be um at one point it'll be
24:38it'll be paid. Uh typically the approach
24:40that we take with our GitHub advanced
24:42security tooling is that it is free for
24:45public repositories. Uh and that's a
24:47pattern that we're going to be following
24:48as well.
24:51>> Awesome. And then will it be integrated
24:53into the local IDE so the developer can
24:56detect it prior even committing to
24:58GitHub?
25:00>> We don't have any uh work in the IDE
25:03coming up on our road map. But for
25:06general IDE I would recommend leveraging
25:09GitHub copilot uh which is able to do
25:13reviews before something goes into a
25:15pull request. So you would get all of
25:17the AI based ones. Uh but we do not yet
25:20have the ability to run the to run the
25:22CodeQL queries in the ID.
25:28Awesome. We'll see if we have any other
25:31questions. Feel free to chime in. This
25:33will be available on demand. But I think
25:36one of the most exciting pieces to this
25:38new release, uh at least for me, is that
25:41it's free, right? So I say join us on
25:44this journey. uh to help shape the next
25:47generation of baking code quality
25:50natively into the developer experience.
25:53Oh, I do see someone added another
25:55question. So, you mentioned it
25:57transitioning to paid in the future.
26:00Will anyone with it enabled and being
26:02used while under the free plan be
26:04grandfathered in to be able to continue
26:06using it?
26:08That is a great question because I do
26:11not have an answer to it right now,
26:13[laughter] but I would recommend uh
26:16keeping an eye on our releases and
26:17notifications like Lupita mentioned. And
26:19there will be a lot more information
26:21about that transition and uh potential
26:24future costs that come down um well
26:27before we start trying to bill for it.
26:31>> Yeah. So I I will say be sure to opt in
26:34to our notifications, GitHub
26:36specifically. There is Microsoft optin
26:38as well. Uh but when you do that
26:41basically you're tuned in to what's
26:44coming next. And honestly um I I see
26:48another question here. Will we be able
26:50to start running across entire repo
26:51versus new commits? I'll let you answer
26:53that.
26:55>> Yeah. So today the code deterministic
26:58analysis does run across the entire
27:00repository. Um and then the AI scanning
27:05is the one that is limited to new
27:08commits. That's a problem that I mean
27:11generally in the in the industry and
27:13across GitHub we're working on. So I
27:15don't have a timeline for that at this
27:16time but it is something that we are
27:18trying to expand.
27:22>> I love all the questions. I love these
27:24to be interactive. Uh I always say I'm
27:27going to hand out prizes uh for the
27:29folks that raise their hand. So, I just
27:32I need more viewers to get that ability.
27:34So, share this with your friends,
27:36support the channel. Look, I got we got
27:38another question. Uh, will I incur cost
27:41and action minutes for enabling this
27:43even though it's free?
27:44>> Yes, becauseQL today runs using GitHub
27:48actions, it will incur actions minutes
27:52>> and those are usually nominal. I always
27:54get that question too when gas is run.
27:56But think about like if you had to run
27:58your own servers, infrastructure,
28:00configuration, setup, cooling, heating,
28:03electricity, maintenance, folks, you
28:06know, physically securing the place. I
28:09think action minutes aren't that big of
28:11a deal. But that's just my personal
28:12opinion. Um, always happy to chat if you
28:15have an interest in or a need in
28:17building a business case internally for
28:19that usage. That's what I'm here for.
28:23Yeah. Any other questions?
28:31All right.
28:33>> Uh, Lupita, one thing I I want to
28:35mention just at the end here, um, as
28:38people try it out, if you have feedback,
28:40please leverage the GitHub community, me
28:43and my development team are like
28:45watching it like a hawk to pick up on
28:48any bugs that people are experiencing,
28:51um, any weirdness, any feedback that you
28:53have. If you go if you go in there, we
28:55have like this one announcement that has
28:58a bunch of people with feedback on it
29:01and you can see me and my team like
29:04responding very actively within that.
29:05So, we love hearing feedback and yeah,
29:09we want your feedback. Give us your
29:10feedback. Uh it's how it's the only way
29:13that we can really be sure that we're
29:14making a great product. Uh and we want
29:16to make a great product.
29:18>> Absolutely. And that question about how
29:20does this compete with sonar cube, this
29:23whole project actually came about
29:25because of the demand and the requests
29:28from our customers. I personally had
29:30like 31 accounts come to me and say,
29:31"When are you guys going to do code
29:33quality?" And it's interesting because
29:35code, the engine that runs the static
29:37analysis security assessments, actually
29:40started as a code quality solution way
29:42back in the day and then involve evolved
29:45into security because of how powerful it
29:47was. And so that being said, I I can let
29:51um Carol here talk about the the details
29:53on the technical side, but at least from
29:54a a business perspective, consolidation
29:57is key for a lot of organizations. While
29:59I always say there's no silver bullet
30:00and it's good to have multiple kind of
30:02solutions to provide coverage where
30:04necessary, um we still want to be at
30:06least able to provide that option as
30:09part of the overall uh portfolio of the
30:12solutions we provide. So Carl, I'll hand
30:14that to you.
30:16>> Yeah. Uh, so in terms of how we compete
30:19with Sonar Cube, uh, I'm going to give
30:23you the awful businessy response and be
30:25like, you are the only one who can
30:27really decide whether or not we compete
30:30well [laughter] with Sonar Cube. Um, if
30:32you're using Sonar Cube today, uh, I
30:35would pro and you're interested in the
30:37GitHub code quality tool, I would
30:39encourage you to turn it on and just
30:41like check it out. Uh there are a lot of
30:44things Sonar Cube does like they're a
30:46product that has existed for years and
30:47years and years. GitHub code quality has
30:50existed for like a couple months and
30:51like I mentioned like we don't even have
30:53test coverage yet. So it's something
30:55that we're working on. But at the same
30:57time we're not expecting during this
30:59public preview phase that it's going to
31:01be replacing any tool for you. But try
31:04it out side by side. We would love to
31:06hear from you the places where we're
31:09falling over that Sonar Cube is
31:11excelling for you and how we can try to
31:13close those gaps.
31:16>> Yeah, absolutely. I always say um with
31:18with quality, right? There is, as Carol
31:22mentioned, no sort of right answer. It
31:24means different things for different
31:26organizations.
31:27And so what we're aiming to do is show
31:30you what our philosophy and approach to
31:33this problem looks like. But because
31:36we're doing this sort of private
31:38preview, you have an opportunity to
31:41contribute and have a say in what that
31:44looks like. So, do not miss out on that.
31:47As you saw, we do not gatekeep.
31:50[laughter]
31:50We are here to collaborate. There's no
31:52room for compromise.
31:54>> Um, you'll be able to replay this
31:56session or re-watch it on demand on
31:58YouTube. And for the question about
32:02security based cost, um, if you are
32:04working on an open-source project, all
32:07of our security solution is free for
32:10open source for anything that's
32:13obviously private or enterprise or um,
32:16not being open to the public. Uh, there
32:19is a cost associated with that, but if
32:21you want to pay me offline, if you're
32:22just working on a personal project, we
32:24can see what options we have there. That
32:26should help answer that question. And
32:29then the last question I see is I would
32:31love to have those features in Sonar
32:33Cube to exist in [laughter]
32:37love.
32:37>> All right, sounds good. I'm just going
32:38to rebuild all of Sonar Cube inside of
32:42GitHub and then everybody will be
32:44satisfied. [laughter]
32:46>> Love it. We [snorts] have AI. Don't they
32:49say it's easy? [laughter]
32:52>> Yeah, I'll write it up. I'll write that
32:53up in an issue. Please add all of the
32:56Sonar Cube features and then I will
32:57assign it to C-pilot coding agent and
33:00co-pilot coding agent's getting pretty
33:01good. I bet it would give it a good a
33:03pretty good shot. [laughter]
33:06>> Totally. I love that. Well guys, this
33:09has been incredibly awesome. I don't
33:11know if there's anyone else that has
33:13anything in the chat. I absolutely love
33:16the interaction. Thanks y'all.
33:21If not, I think we can wrap it. Um, as
33:24mentioned, this will be able to be
33:26replayed on demand on YouTube. We'll
33:29have another session coming up. Again,
33:32like, subscribe, share, um, and add any
33:35topics that you want to learn more
33:37about. Uh, we're always happy to bring
33:39whatever to the table that makes sense
33:41for the folks watching.
33:45All right, thanks everyone. We'll see
33:47you next time.
33:48>> Thank you so much.
33:50>> Bye.
34:01Thank you all for joining and thanks
34:03again to our speakers.
34:06This session is part of a series. To
34:08register for future shows and watch past
34:11episodes on demand, you can follow the
34:13link on the screen or in the chat.
34:17We're always looking to improve our
34:18sessions and your experience. If you
34:21have any feedback for us, we would love
34:23to hear what you have to say. You can
34:25find that link on the screen or in the
34:27chat. And we'll see you at the next one.
34:45Hey. Hey. Hey.
35:07[music]
35:22I feel [music]
35:24you.