> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/sast-and-sca/software-updates/2020-updates.md).
# 2020
## 1 December
**Highlights:** Improvements to our Source Code View and the Jira Plugin, information regarding Qwiet AI by Harness’s findings type coverage, and an Ocular update
### What’s New
**Source Code View Filepath Modifications:** Qwiet AI by Harness’s Source Code View allows you to view the source code location where it identified a vulnerability. We’ve added a flag that will enable you to [customize the file paths](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/ui-v1/application-details/settings#modifying-the-source-code-file-paths-used) used by Qwiet AI by Harness. This helps those whose repositories utilize more than one folder structure (e.g., apps that include multiple nested modules).
**Updated Qwiet Plugin for Jira:** We’ve updated the [Qwiet Plugin for Jira](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/2srkevG7cJxAfBDoJJPN) so that it now supports Jira’s next-gen projects in addition to the classic projects.
**Finding Types Coverage:** One of the questions we get most often is regarding the vulnerability types that Qwiet AI by Harness can identify. To that end, we have published a list of Qwiet AI by Harness’s [finding types coverage](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/coverage). This list is a perpetual work-in-progress and subject to change as our security team identifies additional finding types.
**Ocular:** We’ve released a new version of Ocular that features performance enhancements.
### Blog Posts + Podcasts
* Our security researcher, Claudiu-Vlad Ursache, writes about [visualizing program structure characteristics for 12 million lines of code](https://blog.shiftleft.io/visualizing-program-structure-characteristics-for-12-million-lines-of-code-6c50ec69db8d).
* Horacio Duran, a software engineer on our infrastructure team, writes about how we [integrated our Go services with Jira](https://blog.shiftleft.io/shiftleft-engineering-integrating-your-go-services-with-jira-e31e4aca3d67) to create a stable, bidirectional workflow.
* Our technical writer, Katie Horne, offers tips on [managing your npm dependencies](https://blog.shiftleft.io/tips-for-managing-npm-dependencies-599fc978f9c2) to minimize your exposure to security vulnerabilities.
## 2 November
**Highlights:** Reports available via the Qwiet Dashboard, premium trials, and inside looks at how Qwiet works
### What’s New
**Reporting:** We are pleased to announce the inclusion of [reporting](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/dashboard/reporting) features in the Qwiet Dashboard for users with a premium trial or a team/enterprise subscription. You can now:
* Show top-level statistics for one or more apps (e.g., total findings, number of secrets, insights, vulnerabilities, and the number of new, old, and fixed findings, as well as regressions)
* Show trends charts depicting the growth or decline of findings in apps over time
* Export PDF or HTML reports of your findings data based on your selected timeline (weekly, monthly, or quarterly)
**Premium Trial:** For Qwiet AI by Harness users currently on the Free Tier, we have launched a premium trial that allows you to access additional Qwiet features. For 15 days, you'll be able to scan up to 10 apps (even concurrently) and get their results (including dataflow information). You can also access the Qwiet API, reporting features, and enterprise-level support.
### Blog Posts + Podcasts
Learn from our VP, Products, Alok Shukla, how [we reduced our product demo and onboarding timelines](https://blog.shiftleft.io/shiftleft-tales-reducing-pov-onboarding-times-from-few-weeks-to-less-than-5-minutes-2c9bec4d7e00) from weeks to under five minutes.
Chetan Conikee, our CTO, explains how [we crane lifted Scala onto the Code Property Graph](https://blog.shiftleft.io/crane-lifting-scala-onto-code-property-graph-to-conduct-vulnerability-analysis-229227343a74) to conduct vulnerability analyses.
Preetam Jinka, our lead engineer, walks us through how we [refactored and reimplemented](https://blog.shiftleft.io/refactoring-a-live-saas-environment-5d0911b8b281) almost all of our back-end and UI while maintaining a live SaaS environment.
## 30 September
**Highlights**: combining Java artifacts for analysis, reporting findings to GitHub, and Qwiet AI by Harness performance improvements
### What’s New
* **Combining Multiple Java Artifacts for Analysis**: When scanning your Java apps, Qwiet AI by Harness now allows you to [combine two or more artifacts](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/QDXGQGky0my1mQ9BJ2OC#combining-multiple-artifacts-for-analysis) for code analysis using the --dep flag.
* **Reporting Findings in GitHub**: You can now [report findings](https://app.gitbook.com/s/4t03gua31tHpZwtcczPO/reference/check-analysis#summary-of-findings) from a specific Qwiet AI by Harness scan directly to the GitHub Pull Request (PR). This allows you to display all of your findings on the relevant PR for easy reference.
* **Performance Improvements**: We’ve made a variety of performance improvements to Qwiet AI by Harness so you can expect the findings list to populate 30x faster and the trends chart to populate 12x faster. You can also expect general fixes and improvements to the Qwiet UI and API.
## 15 September
**Highlights**: Viewing trends across scans, integrating with AWS CodeBuild, admin docs, rearchitecture of Ocular's CPG Query Language, and winning the 2020 SINET 16 Innovator Award
### What's New
* **Trends in Findings**: We’ve added a new feature to our Dashboard that allows you to compare two scans and track your [trends in findings](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/dashboard/application-details/vulnerabilities). This feature allows you to get insights like the number of new findings in the later version of the scan, the number of findings common to both scans, the number of regressions (or the reintroduction of corrected issues), and the number of findings that have been corrected between these two scans. Read more about this [on the blog](https://blog.shiftleft.io/new-feature-ability-to-compare-any-two-code-analysis-scans-58f3a1e613ac).
* We have launched a new tutorial on how to integrate Qwiet AI by Harness into [AWS CodeBuild](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/edg0dtr3KwTH9v4VByZn) to enable automated code analysis for applications released via CodeBuild.
* We have released new docs that include information helpful to administrators regarding [user management and API access keys](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/MhFCLh9lnvRqpJcDpvau). We cover the differences between Qwiet admins and collaborators, as well as the basics of what you can do with various API access keys.
* We're placed to announce Ocular release 0.4.1, which introduces a major rearchitecture of the CPG Query Language (CPGQL). This requires a simple migration on your part, and [further details](broken://spaces/w59KBC5RUR1uHzodGm1U/pages/fd6KnJArJW5TMgMhWXNg#041-overflowdb-traversals) on the changes (many of which are under the hood) are available on our docs site.
### Blogs & Podcasts
* Qwiet was named a winner of the 2020 SINET 16 Innovator Award! Read more about this achievement [on the blog](https://blog.shiftleft.io/shiftleft-is-a-sinet16-2020-winner-21552fe1f419).
* Read more about our [security code review of the Cerberus Banking Trojan](https://blog.shiftleft.io/security-code-review-of-a-banking-trojan-cerberus-10df386b9f6b) and [HTTP Request Smuggling](https://blog.shiftleft.io/http-request-smuggling-a-primer-dc5beb2ed9b5) (as well as how to mitigate such security risks).
## 14 August
**Highlights**: Modifying finding severity, scan comparisons, DevSecOps, NoSQL injection, and a conversation with Vincent Weafer of Capital One
### What's New
* **Modifying Finding Severity**: You can [modify the severity of findings](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/kINJlpmA8EZO0Ghjtlf8#modifying-the-severity-of-findings-after-code-analysis) after analysis using custom modification rules. These modification rules match findings and change the severity or CVSS score of the findings
* **Comparing Latest and Last Scans**: We’ve made it easier for you to compare the results of the most recent scan against the results of the previous scan. This feature can be included in your [build rules](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/build-rules#parameters) or can be used by including its [flag](https://app.gitbook.com/s/4t03gua31tHpZwtcczPO/reference/check-analysis#comparing-the-current-and-previous-scans) with `sl check-analysis`
### Changes and Improvements
* Azure DevOps users will find instructions on integrating Qwiet AI by Harness with Pipelines [defined using the Classic interface](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/5pG6ziMJpKj0N8TYGLFy)
### Blogs and Podcasts
* Learn about DevSecOps with [Bitbucket](https://blog.shiftleft.io/devsecops-with-atlassian-bitbucket-8023b1e2284b) and [GitHub](https://blog.shiftleft.io/devops-productivity-series-github-for-devsecops-1fdf70ae22b5), and [read the follow-up](https://blog.shiftleft.io/mitigating-nosql-injection-attacks-part-2-42a2d8890f70) to our first installment on NoSQL injections
* Sources and Sinks: Listen to Alok Shukla’s [conversation with Vincent Weafer](https://blog.shiftleft.io/podcast-ep-2-1-ml-automation-shiftleft-at-capitalone-a-conversation-with-vincent-weafer-7d26517286c2), SVP of Security Engineering at Capital One, on machine learning, automation, and more
## 31 July
**Highlights**: new developer-central AppSec workflows; improved GitHub integration, and improvements to Qwiet AI by Harness and Ocular
### What's New
* We have completely overhauled our Dashboard to make it easier to integrate code analysis into your GitHub workflows:
* You can try out the NextGen Static Analysis (Qwiet AI by Harness) workflow using one of our demo repositories (currently available in seven different languages/platforms, including the recently added [Python](https://docs.shiftleft.io/inspect/analyzing-applications/python) and [Terraform](https://docs.shiftleft.io/inspect/analyzing-applications/terraform))
* From the Dashboard, you can easily integrate Qwiet AI by Harness into your applications whose repositories are hosted by GitHub; with just a few clicks, you’ll have added code analysis to your development lifecycle
### Changes and Improvements
* When [analyzing a Java application](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/QDXGQGky0my1mQ9BJ2OC), Qwiet automatically checks to see if you have the required version of Java Developer Kit; if not, it will download the necessary bundle on your behalf
* In the Dashboard, you can now make [comments and track status changes](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/dashboard/application-details/vulnerabilities) for vulnerabilities; previously, this feature was only available for Secrets and Insights identified by Qwiet AI by Harness
* We’ve implemented performance improvements so that the Dashboard is more performant, as well as many bug fixes to Ocular
### Blogs and Podcasts
* From the Qwiet blog: what [application security can learn](https://blog.shiftleft.io/what-appsec-can-learn-from-developers-feature-bug-workflows-225676c96518) from developers’ workflows, a look at [mitigating NoSQL injection attacks](https://blog.shiftleft.io/mitigating-nosql-injection-attacks-part-1-930756e30d52), and [hunting for 0-days in Cisco Data Center Network Manager (DCNM)](https://blog.shiftleft.io/hunting-0-days-in-cisco-dcnm-with-shiftleft-ocular-a3091bb8ef29?utm_medium=email&_hsmi=2&_hsenc=p2ANqtz-_a9Xr4T1E68GmwP-Son4KYfmXkd1-1Qn0iiPxfmzDzKRiYNsRbTnrJMW35fnc3fXMkB5mC1fVrhWN0aRVeo2La4somBg) with Ocular
* ShiftLeft’s Chetan Conikee takes a look at the [Twilio security breach](https://medium.com/@chetan_conikee/a-case-study-of-twilios-non-malicious-breach-425b0d6898a5)
## 30 June
**Highlights**: Python and Terraform support, C# updates, and GitHub integration using GitHub Actions
### What's New
* Python and Terraform support for Qwiet AI by Harness: You can now analyze your [Python](https://docs.shiftleft.io/inspect/analyzing-applications/python) applications and your [Terraform](https://docs.shiftleft.io/inspect/analyzing-applications/terraform) projects/modules for vulnerabilities using Qwiet AI by Harness
### Changes and Improvements
* We’ve updated our support for C# to include version 8.0 and .NET Core 3.1. We’ve also made performance improvements so that you can, on average, expect speeds that are 1.5x faster and 75% less memory consumption (compared to our previous version) when analyzing C# apps
* We’ve updated our [GitHub tutorial](https://docs.shiftleft.io/inspect/workflows/github) to show you how to use GitHub Actions to integrate Qwiet AI by Harness into your Pull Request (PR) process
### Blogs and Podcasts
* Read our CTO Chetan Conikee’s [five-part series](https://blog.shiftleft.io/an-oxymoron-static-analysis-of-a-dynamic-language-part-1-9ac5cdc158c1) on considerations regarding the static analysis of applications written in dynamic languages (notably JavaScript)
* Listen to Julie Tsai’s, Head of Information Security at Roblox, [thoughts](https://blog.shiftleft.io/podcast-ep-7-shifting-left-at-roblox-a-conversation-with-julie-tsai-90434133b42c) on shifting left in cybersecurity and code analysis
## 29 May
**Highlights**: TypeScript support, improvements to the Dashboard, running Ocular queries as an overlay creator, and a new Docs site
### Changes and Improvements
* Both Qwiet AI by Harness and Ocular's JavaScript capabilities support apps written in TypeScript
* Each secret and insight identified by Qwiet AI by Harness now [displays](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/dashboard/application-details/vulnerabilities) comment and status change history
* You can now run an Ocular query as an overlay creator via the `run()` API. For example, you can tag all methods starting with `handleRequest*` as `MY_METHOD` using `run(cpg.method.name("handleRequest*").newTagNode("MY_METHOD"))`. This applies the tag to the selected methods as an overlay
* You can now write [build rules](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/build-rules) and use `sl check-analysis` to compare two versions of your code and see the differences in fixed and newly-introduced vulnerabilities
* We've launched a new [documentation](broken://spaces/ltpCxqDmXivgAxvALI7q/pages/TzD2Wm5rf4KttUl0LJ4S) site, which includes lots of new content related to Ocular
## 15 May
**Highlights**: Improvements to the Dashboard and Ocular + a conversation with Emirates
### Changes and Improvements
* The Dashboard now shows the counts of Secrets and Insights identified in the [Apps List](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/dashboard/application-overview) and the [Version History](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/dashboard/application-details/vulnerabilities)
* Ocular CPGs are no longer left in an inconsistent state on disk if you exit without saving the graph
* Ocular users can now import a small snippet of code into Ocular and plot it using `cpg.method.name("main").plotAst`. The image viewer then opens to display a plot of the abstract syntax tree (AST)
* You can configure Ocular's image viewer displaying your plots using `config.tool.imageViewer`
### Recommended Blog Posts and Podcasts
A [conversation](https://blog.shiftleft.io/podcast-shiftleft-at-emirates-group-a-conversation-with-toufiq-ali-350b665412d6) with Toufiq Ali, Principal Cybersecurity Engineer at Emirates Group, on the need for integrating security into development pipelines
## 30 April
**Highlights:** JavaScript support, identification of Secrets and Insights, APIv4, extending the Ocular schema, plus improvements to Ocular
### What's New
* **JavaScript support for Qwiet AI by Harness and Ocular**: You can now analyze your JavaScript applications for vulnerabilities using [Qwiet AI by Harness](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/tqRsHXiAf5jvFTWXnTCO) and Ocular (which also supports apps using ExpressJS)
* **Secrets and Insights**: We've updated Qwiet AI by Harness so that it now identifies the presence of [security-sensitive functions (or Insights)](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/analyzing-applications/insights) (JavaScript only) and [hard-coded credentials (or Secrets)](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/sIl39JB7zrQrywVncz6X) in your application
* **APIv4**: We've released a new version of the API to return the results of individual scans for apps and to export identified insights and secrets
* **Extend the Ocular Schema**: Use [schema-extender](broken://spaces/w59KBC5RUR1uHzodGm1U/pages/BCggFjA1lV7HAzMUauw0), which ships by default with Ocular, to extend any of the default Code Property Graph schemas
### Changes and Improvements
* We've made the following changes to several key Ocular commands:
* Deprecated `createCpg()` in favor of `importCode()`
* Deprecated `createCpgAndSp()` in favor of `importCode()` followed by `run.securityprofile`
* You can add overlays on a Code Property Graph (CPG) using `run` (which runs the Ocular analyzer on the active CPG) (e.g., `run.`). To see the available list of passes, scripts, and tools, type `run.` followed by **tab**
* The error messages and logs generated by Ocular are now cleaner and easier to read
* For **LLVM** users running Ocular:
* The new strict mode flag `-strict-mode` turns all **warnings** into **errors**, terminating the process
* Ocular warns you if debug information or any recommended flags are missing when creating Code Property Graphs from LLVM bitcode
* We've added mappings for the **bcopy** and **memcpy** C/C++ functions for use with policies
### Recommended Blog Posts and Podcasts
* [Vulnerability Chains: Learning from Pedro Riberio’s IBM Data Risk Manager Zero-Day Disclosure](https://blog.shiftleft.io/vulnerability-chains-learning-from-pedro-riberios-ibm-data-risk-manager-zero-day-disclosure-7a3a9101806e): Deconstructing IBM's zero-day disclosure, how they can be linked together to offer privileged host access, how the vulnerabilities could have been identified and the lessons learned
* [Sources and Sinks with Mark Kraynak](https://medium.com/sources-and-sinks/surviving-2008-navigating-2020-a-conversation-with-mark-kraynak-130f4324ae45): Surviving the economic downturn of 2020 using lessons learned in 2008
* [Dev + Sec + Ops != DevSecOps](https://blog.shiftleft.io/dev-sec-ops-devsecops-5d05e3516e00): How to implement application security correctly so that your resulting DevSecOps team doesn't look like three independent things that are weakly glued up (Dev + Sec + Ops is not DevSecOps)
## 15 April
**Highlights:** How to create Jira issues to manage and track vulnerabilities Qwiet identifies plus blog posts and podcasts related to Qwiet and application security
### What's New
* **Jira Plugin for ShiftLeft**: The [Jira Plugin](broken://spaces/lJyA24omPa8yzz8MNf2k/pages/2srkevG7cJxAfBDoJJPN) allows you to use the Qwiet Dashboard to create individual tasks in Jira to manage any vulnerabilities identified.
### Recommended Blog Posts and Podcasts
* [Inserting Security into GitLab Merge Requests](https://blog.shiftleft.io/inserting-security-in-gitlab-merge-requests-55f6d297ed4f): Qwiet AI by Harness makes it easy to insert static code analysis into your merge requests workflow. Learn how to do so with GitLab.
* [Does my Scala Value Class really not get allocated?](https://blog.shiftleft.io/does-my-scala-value-class-really-not-get-allocated-b482e86fc3fb): Learn about using Scala's Value Classes and successfully avoiding allocations to minimize runtime overhead.
* [Sources and Sinks, Episode 2: Software Securibility with Shannon Lietz](https://medium.com/sources-and-sinks/podcast-software-securibility-with-shannon-lietz-intuit-ef61a4174a44): Listen to our discussion with Shannon Lietz, Director of Adversary Management at Intuit, about software securibility, specifically code exploits, understanding of protocols and business knowledge, and threat knowledge.
## March
**Highlights:** learn how to automate code analysis in your Jenkins build process, see improvements to the UI (including the new Source Code Views) as well as the Applications List performance
### What's New
* **Jenkins Plugin for Ocular**: [This plugin](broken://spaces/w59KBC5RUR1uHzodGm1U/pages/dZxqPceHoeHCIUWyH5pi) allows you to automate code analysis during the build process using Ocular. With the plugin, you can set Jenkins to run Ocular as a final build step in a Pipeline project.
* **New Dashboard User Interface**: The new Qwiet Dashboard features an improved user interface designed to make it easier for you to review application information and to find vulnerabilities of interest.
* **Source Code View**: You can configure ShiftLeft's ability to [automatically link](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/ui-v1/application-details/settings) identified vulnerabilities listed in the Qwiet Dashboard to the source code where the vulnerability can be found. This makes it easy for you to find the origins of a specific vulnerability.
* **New `sl` CLI Commands**: [The `sl analyze` command](https://app.gitbook.com/s/4t03gua31tHpZwtcczPO/reference/analyze-options) comes with two new flags for use with the new Source Code View features: `--git-remote-name` and `--no-vcs-metadata`.
### Improvements
* We've improved the Applications List performance; organizations with a large number of applications will see faster vulnerability counts and analysis progress.
## January and February
**Highlights:** learn how to integrate Qwiet into your GitHub workflow, create custom build rules, see improvements to the Vulnerabilities API, and tell us your thoughts on where we should go with ShiftLeft
### What's New
* **PR Workflow**: Learn how you can integrate Qwiet AI by Harness directly into your Git workflow so that your code is analyzed whenever you create a new Pull Request
* **Build Rules**: We've added support for custom [build rules](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/build-rules), allowing Qwiet to compare the results of its analyses against your build rules to determine if the build should fail or not. You can include your build rules in your app's repository so that you can create custom rules on a per-application basis and keep things updated with version control
* **The `sl` option**: The `sl` command now comes with [the `check-analysis` option](https://app.gitbook.com/s/4t03gua31tHpZwtcczPO/reference/check-analysis-options). This allows you to manually trigger a comparison between ShiftLeft's analysis results and the [build rules](https://app.gitbook.com/s/lJyA24omPa8yzz8MNf2k/sast/build-rules) that you can now include with your app
* **Vulnerabilities API**: We've updated the Vulnerabilities API and its Dashboard so that you can easily:
* Filter for vulnerabilities based on the application's branch tag
* See the application version where a vulnerability was first introduced
* **Ideas Portal**: We've opened up the [Ideas Portal](https://ideas.shiftleft.io/), where you can request new features for Qwiet, see what features others have asked for, and vote on ideas that you like
### Bug Fixes
* We've fixed the Dashboard so that **DataFlows information** (specifically line numbers, file names, and method names) displays correctly
* The **Dashboard** now displays an error if you exceed the 15-minute code analysis timeout for self-serve licenses