Corgea: AI-Powered SAST Code Security Scanner & Fixer 116

Corgea is a SAST security detection tool capable of discovering security issues such as business logic vulnerabilities and code logic vulnerabilities. It can detect SQL injection and cross-site scripting attacks, with a very low false-negative rate of no more than 5%. It also automatically fixes 74% of security issues, saving up to 6 hours per person per week. It supports multiple languages including Java and Python, and provides code fix suggestions, policy management, and blocking rule features.

Feature Modules

• Vulnerability Detection: Identifies business logic vulnerabilities such as authentication bypass; code logic vulnerabilities like SQL injection, cross-site scripting (XSS), and insecure deserialization; as well as hardcoded credentials and sensitive information exposure.

• Optimization: Filters out a significant number of false positives, reducing tickets by approximately 30%, with a false positive rate controlled below 5%.

• Auto-Fix: Automatically fixes 74% of security issues and provides code modification suggestions, such as converting SQL injection issues into parameterized queries, saving developers over 6 hours per week.

• Multi-Language Support: Compatible with languages and frameworks including Java, JavaScript, TypeScript, Go, Python, and C#.

• Scanning & Analysis: Uses the Corgea-Blast engine to scan code. Reports contain vulnerability severity (Critical/High/Medium/Low) and fix status information.

• Policies & Blocking Rules: Define business policies using natural language, such as medical data encryption requirements, and set up blocking rules to prevent non-compliant code from being merged.

• Integration & Developer Experience: Integrates with GitHub and Azure DevOps (GitLab and Bitbucket will be supported in the future), and code fixes can be pushed directly into the IDE.

Use Scenarios

• Vulnerability Prevention: Detects vulnerabilities before code is committed, such as authentication bypass vulnerabilities in pygoat projects, preventing them from being discovered by attackers or penetration testers.

• Efficiency Improvement: Automatically generates fix code, such as converting hardcoded SQL queries into parameterized queries, saving considerable manual fix effort.

• Compliance Management: Matches enterprise architecture through custom policies, such as private network communication and ORM usage standards, reducing compliance risks.

How to Use

1. Install Integration: Supports GitHub App, Azure DevOps plugin, and CLI tool (npm install -g corgea-cli).

2. Scan Configuration: Configure scan rules via the .corgearc file, supporting multiple languages (such as JavaScript, TypeScript) and rule categories (such as authentication).

3. Fix Workflow: Automatically creates fix PRs, which developers review and merge, while tracking vulnerability status.

Pros and Cons

Pros:

• Vulnerability detection rate improved by 74%.

• Low false positive rate, below 5% (industry average is 30%).

• Supports multiple languages (Java, JS, Go, Python, etc.).

• Developer-centric design philosophy.

Cons:

• Does not currently support mobile languages (Kotlin/Swift).

• Enterprise edition has a high starting price.

• Private deployment is only available in the Enterprise edition.

Pricing Plans

• Free Edition: 2 repositories, 10 PR scans per month, 10 auto-fixes.

• Starter Edition ($14): 5 repositories, 30 PR scans per month, 50 auto-fixes.

• Growth Edition ($29): 10 repositories, 150 PR scans per month, unlimited auto-fixes.

• Scale Edition ($49): Unlimited repositories, unlimited PR scans, unlimited auto-fixes, supports malicious code scanning and SLA management.

• Enterprise Edition: Unlimited repositories, unlimited PR scans, unlimited auto-fixes, supports malicious code scanning, SLA management, and private ai model.