Sonar workshop: wiring SonarQube scans into a Codex agent loop to fix SQL injection live
AI Engineer · youtube · 2026-10-12
AI Engineer World's Fair published a full workshop by Sonar's Killian Carlsen-Phelan demonstrating an agentic security workflow with SonarQube and OpenAI Codex.
- Uses a small Python project deliberately seeded with a hardcoded API key and a SQL injection path
- Sets up SonarQube Cloud, CLI, plugin and MCP server around a guide-verify-solve loop, moving security feedback inside the coding loop
- Live fix: replacing string interpolation with a parameterized query, then a verification hook re-scans the edit
- A secrets hook blocks a fake credential in a prompt; an issue-listing skill feeds dashboard evidence to the agent
- Q&A covers hook bypasses, local vs container execution, and entitlement-gated features
More from coding & agent
- Claude Code Pushes Urgent Security Update Across All Installations — umeshonai · 2026-10-23
- Claude cut a 2.6-hour video export to 20 minutes — but only after being told to rebuild the server — byhewar · 2026-10-23
- 3 flight-booking rules my AI agent checks that I'd never do by hand — Efistoffeles · 2026-10-23
- OpenJet claims Qwen3.8-27B coding runs 1.9x faster than llama.cpp on one RTX 3090 — JeremyCMorgan · 2026-10-23
- Building an autonomous SEO agent in Hermes with three skills: programmatic pages, Keywords Everywhere, DataForSEO — EXM7777 · 2026-10-23
- Building a sports betting AI agent with onchain execution and human approval by default: architecture and lessons — Dry-Comfortable-2678 · 2026-10-23