Synopsys Code Sight (VS 2022)

The Synopsys Software Integrity Group is now Black Duck®. Please follow these instructions to manually re-install Code Sight in order to receive future updates.

Synopsys Code Sight for Visual Studio 2022 v17.1+

The Synopsys® Code Sight™ extension helps you find and fix security and quality issues in your software while you code. It can quickly identify vulnerabilities in both source code and open source dependencies, and help you fix them right in the IDE. Once the issues have been identified, Code Sight provides detailed remediation guidance and access to training directly in the IDE to help you quickly fix issues today and write better code going forward.

Code Sight uses integrated, lightweight analysis of your code and open-source dependencies without requiring a heavyweight Static Analysis (SAST) or Software Composition Analysis (SCA) tool.

Code Sight can be used as a standalone extension for secure development (free trial available) or included with active subscriptions to other Synopsys Application Security Testing (AST) solutions.

Code Sight Extension for Black Duck, Coverity, the Polaris Platform, and Software Risk Manager

Extend the capabilities of your Synopsys tools to the developer desktop

Users subscribing to the Polaris Software Integrity Platform®, Software Risk Manager (formerly Code Dx), or Coverity® SAST can leverage the rapid, lightweight Code Analysis and Open Source Analysis for free, directly within the IDE. Users subscribing to Coverity® SAST or Black Duck® SCA can leverage the rapid analysis for free, as well as additional analysis capabilities enabled by their solution.

After you install the Code Sight extension, simply select the solution(s) for which you have an active license (e.g., Coverity, Black Duck, the Polaris platform, Software Risk Manager) to use Code Sight with these solutions.

Code Sight Free Trial

Sign up for a free trial of Code Sight and get started in only a couple of minutes.

Sign-up for the trial directly within the extension and start scanning code in less than five minutes. Contact us if you have any license or product questions.

Using Code Sight

Follow these simple steps to use the Code Sight IDE extension to analyze your projects:

Install Code Sight
To activate Code Sight, you may:
- Connect Code Sight to your Black Duck instance,
- Connect Code Sight to your Coverity instance,
- Connect Code Sight to your Polaris platform instance,
- Connect Code Sight to your Software Risk Manager (SRM) instance,
- Register for your Free Trial of the Code Sight standalone extension,
- Activate a Code Sight standalone license
To perform a local scan of your code base:
- Click the triangular “scan” button beside Code Analysis or Open Source Analysis to perform a local scan of your codebase and display detected risks
- Select any issue from the results list to view more details and any recommended fixes
To display issues from your Polaris platform, Coverity or SRM server:
- Select the "Team View" tab to display issues detected by those solutions during non-local, server-based project scanning
- Select any issue from the results list to view more details and any recommended fixes

For more information on connecting Code Sight to other Synopsys AST solutions or to learn more, please refer to:

Tech Specs

Code Sight can scan large projects and development artifacts in seconds, including:

Web and mobile application files
Microservices
Infrastructure-as-Code (IaC) configurations

Code Sight will alert you to any detected issues, including:

Code security risks
API safety standards
Cryptography issues
Hard-coded secrets
Vulnerabilities in your open-source dependencies (e.g. Log4j CVE-2021-44228)

Code Sight provides helpful risk insight, including:

CVE classifications
CVSS ratings
Issue description and how it presents in context
Detailed patch recommendations and remediation guidance
Policy violations (when connected to Black Duck or SRM)
Relevant developer security training to fix and avoid the issue (when connected to SRM or Coverity Connect and subscribed to Synopsys Developer Security Training, powered by Secure Code Warrior)

License Terms

By downloading this extension, you are agreeing to the Synopsys End User License Agreement. Users with active commercial licenses for Coverity, Black Duck, the Polaris platform, or SRM can also use Code Sight free of charge.

Synopsys Inc.