Killian Carlsen-Phelan

More security checks should mean more confidence, not more alerts to ignore. As AI accelerates code production, how do we add independent verification without turning development into an obstacle course? This session explores two dimensions of application security: using complementary analysis methods and placing checks at useful points throughout the software development lifecycle.

Gitar is Sonar’s AI code verification agent, complementing SonarQube with an understanding of each change’s context and intent. In this hands-on workshop, you’ll install Gitar as a GitHub App and use it across three pull request scenarios that show how verification goes beyond code review.

Coding agents don't know your architecture, your team's standards, or the issues SonarQube already flagged in the files they're editing. So they guess, and those guesses come back as failed quality gates and PRs sent back for rework. The faster your agents run, the more of this piles up.