Taylor Luttrell-Williams demonstrates SonarQube Hunter Agent in a 14-minute talk on AI Engineer, focusing on authorization and business-logic failures.
Look across the application
- Static application security testing, or SAST, checks code for known vulnerability patterns; application-specific rules also need context about intended behavior.
- Hunter Agent maps a repository, then runs specialists for access control, business logic, and authentication/session handling.
- Sonar says adversarial validation and noise filters challenge candidate findings before they enter the issue list.
What the demonstration shows
- A previously completed scan took about an hour and returned 46 findings in the presenter’s Python application.
- One finding traces an authorization failure to users being able to edit their own role field and gain admin access.
- Another identifies protected routes reachable with a password alone, bypassing multi-factor authentication.
- Each issue includes its location, explanation, suggested repair, severity, and assignment workflow in SonarQube.
Turn findings into controlled work
- The demonstrated UI distinguishes accepting a valid issue without blocking delivery from confirming it so it affects a quality gate.
- Scans can run on demand or on a schedule against a selected branch.
- The presenter announces automatic remediation through a separate agent and Sonar’s participation in OpenAI’s Daybreak partner program.
- Keep conventional scanning alongside agent review, with human triage and verification of proposed fixes.
Caveat: this is a vendor demonstration of one application. The 46 findings do not measure detection accuracy or prove that every reported issue is exploitable.
“We then run adversarial validation to make sure that the issues are actually correct and not false positives.” — Taylor Luttrell-Williams