Synopsys Code Sight for Visual Studio Code

The Synopsys® Code Sight™ extension helps you find and fix security and quality issues in your software while you code. It can quickly identify vulnerabilities in both source code and open source dependencies, and help you fix them right in the IDE. Once the issues have been identified, Code Sight provides detailed remediation guidance and access to training directly in the IDE to help you quickly fix issues today and write better code going forward.

Code Sight uses integrated, lightweight analysis of your code and open source dependencies without requiring a heavyweight Static Analysis (SAST) or Software Composition Analysis (SCA) tool.

Code Sight can be used as a standalone extension for secure development (free trial available) or included with active subscriptions of other Synopsys Application Security Testing (AST) solutions.

Code Sight Extension for Black Duck, Coverity, the Polaris Platform, and Software Risk Manager

Extend the capabilities of your Synopsys tools to the developer desktop

Users subscribing to the Polaris Software Integrity Platform® or Software Risk Manager (formerly Code Dx) can leverage the rapid, lightweight Code Analysis and Open Source Analysis for free, directly within the IDE. Users subscribing to Coverity® SAST or Black Duck® SCA can leverage the rapid analysis for free, as well as additional analysis capabilities enabled by their solution.

After you install the Code Sight extension, simply select the solution(s) for which you have an active license (e.g., Coverity, Black Duck, the Polaris platform, Software Risk Manager) to use Code Sight with these solutions.

Code Sight Free Trial

Sign up for a free trial of Code Sight and get started in only a couple of minutes.

Sign-up for the trial directly within the extension and start scanning code in less than five minutes. Contact us if you have any license or product questions.

Using Code Sight

Follow these simple steps to use the Code Sight IDE extension to analyze your projects:

1. Install Code Sight
2. To activate Code Sight, you may:
   • Connect Code Sight to your Black Duck instance,
   • Connect Code Sight to your Coverity instance,
   • Connect Code Sight to your Polaris platform instance,
   • Connect Code Sight to your Software Risk Manager (SRM) instance,
   • Register for your Free Trial of the Code Sight standalone extension,
   • Activate a Code Sight standalone license
3. To perform a local scan of your code base:
   • Click the triangular “scan” button beside Code Analysis or Open Source Analysis to perform a local scan of your codebase and display detected risks
   • Select any issue from the results list to view more details and any recommended fixes
4. To display issues from your Polaris platform or SRM server:
   • Select the "Team View" tab to display issues detected by those solutions during non-local, server-based project scanning
   • Select any issue from the results list to view more details and any recommended fixes

For more information on connecting Code Sight to other Synopsys AST solutions or to learn more, refer to the following:

• Black Duck: Guided Walkthrough | Quick Start Guide
• Coverity: Guided Walkthrough | Quick Start Guide | Enabling scans
• Polaris platform: Guided Walkthrough | Quick Start Guide
• Software Risk Manager (SRM): Guided Walkthrough | Quick Start Guide
• Code Sight standalone extension: Guided Walkthrough | Quick Start Guide

Additional information about the Code Sight extension can be found here:

• Documentation
• Tutorials
• Interactive Tours

Tech Specs

Code Sight can scan large projects and development artifacts in seconds, including:

• Web and mobile application files
• Microservices
• Infrastructure-as-Code (IaC) configurations

Code Sight will alert you to any detected issues, including:

• Code security risks
• API safety standards
• Cryptography issues
• Hard-coded secrets
• Vulnerabilities in your open source dependencies (e.g. Log4j CVE-2021-44228)

Code Sight provides helpful risk insight, including:

• CVE classifications
• CVSS ratings
• Issue description and how it presents in context
• Detailed patch recommendations and remediation guidance
• Policy violations (when connected to Black Duck or SRM)
• Relevant developer security training to fix and avoid the issue (when connected to SRM and subscribed to Synopsys Developer Security Training, powered by Secure Code Warrior)

License Terms

By downloading this extension, you are agreeing to the Synopsys End User License Agreement. Users with active commercial licenses for Coverity, Black Duck, the Polaris platform, or SRM can also use Code Sight free-of-charge.

Resources

Support Portal

Synopsys Website

Request SBOM: email sig_sbom_request@synopsys.com

Contact Us