Combining Claude Code review with SonarQube for layered code verification

·9 views

A developer on r/ClaudeCode asked whether Claude Code's /code-review command wastes tokens, citing reports of long runs and heavy session usage. The article notes these figures are user-reported and depend on plan, model, effort level, and review scope. It argues for splitting the work: rule-based tools like SonarQube settle clear yes-or-no problems such as hardcoded secrets or injection risks, while AI review handles judgment-based questions like whether a change matches its spec. The author, who works at Sonar, demonstrates on a sample Flask pull request where a deterministic layer and an agentic AI layer together caught security, logic, and test-coverage issues. The piece concludes that the two layers complement rather than replace each other.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Bitwarden Collection Management Settings Determine What Admins Can Access

Bitwarden organizations share vault items through collections, which define who can see or manage specific items. A collection-management setting decides whether owners and administrators automatically gain access to every collection or must be granted access explicitly. This distinction matters during incident response, since an admin who manages users may still be unable to read a protected collection. The article also notes that ZoomEye product counts reflect software footprint rather than exposed or misconfigured organizations. It recommends auditing roles, collection membership, group associations, and export capabilities, and revoking access thoroughly after an account compromise.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Self-Hosted n8n Audit Trail: Tracking Workflow Changes, Access, and Runs

A guide published on DEV Community explains how to build an audit trail for self-hosted n8n, since the platform lacks a built-in compliance console. It recommends treating audit records as three append-only streams: workflow version snapshots, access and credential events, and production execution summaries, all written to a Postgres table the operator controls. The article provides a sample table schema and advises storing identifiers, counts, hashes, and status rather than full payloads to keep personal data out of the log. Suggested methods include scheduled workflow exports that record a new entry only when the content hash changes, or Git-based backups mirrored into Postgres. It also recommends logging workflow activations, credential events by ID only, and login events from a reverse proxy or SSO layer.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Senatus Adds Transparent, Criteria-Based Scoring to Its AI Policy Debates

AI Senatus, a platform where AI senators argue policy questions in turns, has made scoring part of each debate rather than a verdict added at the end. Each argument is judged separately on its evidence, its costs, and the people it affects, so that claims are not blended together. The reasoning behind each score is shown alongside it in plain language, letting readers see and challenge how the judgement was reached. Early attempts had rewarded fluent writing over substance, and the separated criteria and shorter explanations were introduced to address this and to keep readability high. The site remains small and attracts readers who tend to finish a single debate, so the team plans shorter debates on narrower questions and tighter scoring explanations.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AWS Kiro Bots Default to Trust Mode, and Crew's Sandbox Leaves ~/.ssh Visible

AWS's Kiro team made bots generally available in Kiro Crew on November 5, letting users run named agents that handle ongoing tasks such as issue triage or CI monitoring. The article notes that newly created bots start in Trust mode, which acts without per-action approval, subject to a security policy. Crew's default sandbox setting, auto, hides some credential directories but leaves .aws, .ssh and .kube visible to agent subprocesses, though direct file-tool reads of credential files are blocked. The author advises users to review these defaults before granting bots access to sensitive systems such as CI pipelines.

0 comments Read more at DEV Community