Qoder Security Officially Launches: Assigning a Dedicated Security Engineer to Every Developer

With the widespread adoption of AI-powered coding, the volume and scope of code changes have grown exponentially—yet enterprises’ code security review capabilities have failed to keep pace, leading to continuously escalating systemic risks. Traditional code security approaches suffer from three major pain points: high false-positive rates(excessive noise), poor interpretability, and late-stage intervention.

In the era of AI coding, security should no longer be a gatekeeper applied only after development is complete; instead, it must become an intrinsic capability woven throughout the entire coding lifecycle—capable of safeguarding against risk while keeping up with the accelerated delivery cadence demanded by the AI era. What we need is a next-generation code security capability that proactively provides guidance and embeds security natively into the development workflow.

Today, this vision has materialized into a concrete product solution in the code security space. Qoder Security is now officially launched, embedding security natively within Qoder across every stage—from requirement modeling and coding to code commit. By delivering out-of-the-box capabilities such as “three-layer in-session security protection” and “in-session remediation upon issue detection,” Qoder Security sets a new industry benchmark, becoming the first mainstream agentic AI coding platform in China to offer such integrated, proactive security features.

Now available globally, Qoder Security is supported out of the box in both Qoder Desktop and Qoder CLI for Qoder CN. Simply enable it with a single click in settings; no additional plugins or configurations are required.

Let’s start with the results. Compared to traditional approaches, Qoder Security improves vulnerability detection rates by approximately 60%. Many security issues that previously slipped through detection and made their way directly into repositories can now be caught right during the coding phase.

False-positive alerts have been reduced by roughly 80%,saving developers from sifting through overwhelming volumes of noisy, irrelevant warnings.

The time required to identify and remediate a single vulnerability has been shortened to just hours—a process that traditionally took days or even weeks.

Prior to its official launch, we conducted internal testing of Qoder Security on a range of production-grade open-source projects and AI infrastructure components. These projects feature active communities and mature engineering practices, including several widely adopted, high-profile projects used by developers worldwide. Despite their robustness, our testing still uncovered over 600 security issues.

A critical remote code execution vulnerability has been disclosed in Fastjson. Attackers can exploit this flaw by crafting malicious input data to trigger the vulnerability and execute arbitrary code on the target system, posing a severe threat to business systems and data security.

Qoder Security now supports detection of this specific vulnerability. If developers use Fastjson to parse external input during AI-assisted coding, Qoder Security can automatically scan the code, rapidly identify such risks, and enable timely remediation—effectively blocking the security threat before the code reaches production.

Post-Scanning Can't Keep Up with the Speed of AI Code Generation

The speed at which AI writes code is becoming the speed at which vulnerabilities enter repositories. Over 40% of new code globally is now generated with AI assistance. A multi-layered validation study conducted this July on nearly 9,000 C++ programs found that, even when controlling for code length and test pass rates, AI-generated code is about twice as likely to trigger confirmed runtime violations compared to human-written code.

Most teams don't lack scanning tools; the problem is that the feedback comes too late. Security platforms are isolated from the coding interface, and scanning is usually concentrated in the CI stage, with reports arriving at the very last moment before deployment. By the time developers get to fix the issues, the context in which the code was written may already be lost, and false positives in the reports require manual, line-by-line verification.

Another limitation lies in the detection methods themselves: regex can identify obvious patterns like hardcoded keys, but it cannot cover logical issues like "validation is written but can be bypassed."

Leading international vendors have already begun making their moves. Earlier this year, OpenAI launched Codex Security, opting for a repository-level scanning approach, while Anthropic integrated security review capabilities directly into the coding sessions of Claude Code. The two approaches differ, but the industry shares a common consensus: security checks must be brought back to the exact moment the code is born.

Qoder's choice is to embed security protection directly within the agent's coding session.

From Static Scanning to Proactive Security

Among mainstream domestic Agentic Coding products, Qoder Security is the first to productize "three layers of in-session security protection + fixing issues within the same session."

Behind this is a paradigm shift in technology: elevating code security from "static scanning" to "proactive security." Traditional solutions rely on rule matching for known patterns. Qoder Code Security, powered by a proprietary security large model, understands code context and taint propagation paths, self-verifying the reachability of detected issues to report only genuinely reachable risks.

Once an issue is found, the coding agent directly completes the fix, and the next scanning loop closes the loop, leaving no security debt behind. It's like assigning a dedicated security engineer to every developer to review, verify, and fix issues in stages.

Another key design is the dual-agent collaborative architecture. The coding agent and the security review agent are completely independent, avoiding the trap of "giving oneself a perfect score after making changes." The security review agent is further divided into scanning and verification sub-agents, thereby improving the accuracy of detection results.

Three Layers of Defense: A Progressive Approach

Introducing security reviews into the coding process requires first solving the issues of cost and latency. If every single line of code were fully reviewed by the most powerful large model, compute costs would quickly spiral out of control, and response latency would noticeably degrade the coding experience. Therefore, Qoder Security adopts a three-tier design, with each layer handling its specific responsibilities.

Layer 1: Real-time Regex Interception.

Operating at the character stream level, it screens for known high-risk patterns as the code is generated. Issues like dangerous function calls are detected and auto-fixed instantly. With zero latency and zero extra compute overhead, it's free and acts as the first line of the defense line.

Layer 2: Semantic Incremental Review.

Once a task is completed, the system offers a follow-up suggestion at an appropriate time: "Scan for code security risks." It only reviews the incremental code from the current changes, but it looks at both the actual code and the underlying intent. Risks that require semantic understanding to identify—such as SQL injection, Remote Code Execution (RCE), and sensitive information leaks—are mostly caught at this layer.

Layer 3: Cross-file Deep Review.

Before submitting the code, the system proactively asks whether to perform a scan. Qoder Security tracks the complete data flow across files and functions, from the taint source to the dangerous sink, uncovering hidden correlated vulnerabilities that are impossible to see from a single-file perspective.

Take this scenario as an example:When implementing an export feature for a "Billing Query" API in a trading system, the AI uses Runtime.getRuntime().exec() to invoke a system command. This line of code is flagged by the first layer of defense the moment it is generated.
Debug logs print billing amounts and card numbers in plain text. While regex cannot determine what this field represents, semantic review identifies it within seconds.
Before submission, the deep scan traces the HTTP query parameters through the Service layer and across three files, ultimately pinpointing a deserialization call in a shared caching utility where autoType is enabled without any whitelist restrictions. This forms a Remote Code Execution (RCE) chain that could be exploited by crafting malicious payloads—a vulnerability impossible to detect by looking at any single file in isolation.
Once all three issues are detected, remediation suggestions are provided. The user confirms, the main Agent applies the modifications and presents the diff for review. The entire process takes less than ten minutes.
None of the three layers of protection will interrupt the coding process. The first layer runs automatically, while the latter two prompt the user to initiate a scan at appropriate times, running only upon explicit approval.

This workflow has already been in active use within our internal development teams for some time. Since adopting Qoder Code Security, security-related feedback in code reviews has decreased by approximately 35% to 45%—demonstrating that risks are being caught and resolved earlier, right where they originate: during coding.

How to Enable

Qoder DesktopFirst, update Qoder Desktop to the latest version. Then, navigate to the Quest Window: Settings > Security, and toggle on the master switch "Enable Security Review". The three scan layers—Static Analysis, Lightweight Scan, and Deep Scan—are enabled by default.

Qoder CLIQoder CLI supports the same capabilities starting from version 1.1.0: simply enter /security-settings to view and manage the three layers of defense. This feature is available for both the International and China (CN) versions.

Afterward, you can proceed to code as usual. Detection runs in real-time by default, similar to syntax highlighting. The system will proactively ask if you want to perform a scan at appropriate times, requiring no commands to memorize.

For both Desktop and CLI, you can also manually initiate a scan at any time by entering /security-scan, or by simply saying "Help me check if there are any risks in the code."

Finally, here are two important notes on scope:Qoder Security is designed to complement CI and manual reviews. It focuses on "shifting left" during the coding phase for early detection and remediation, while compliance logging and governance remain the responsibility of your existing processes. Security scans may still produce false positives, and the decision to adopt suggestions always rests with the developer.

AI makes coding faster, but "producing vulnerabilities faster" is not the answer the industry is looking for. For sustainable Agentic Coding, security should be the default setting. Only when it is secure and trustworthy can agents create value at scale.

Security starts with the first line of code.

Get Started

Let security start from the first line of code. Qoder Security is currently available in the following products:

Qoder Desktop (IDE) guide: https://docs.qoder.com/qoder-security-guide
Qoder CLI guide: https://docs.qoder.com/en/cli/security

Community

Qoder Security Officially Launches: Assigning a Dedicated Security Engineer to Every Developer

Post-Scanning Can't Keep Up with the Speed of AI Code Generation

From Static Scanning to Proactive Security

Three Layers of Defense: A Progressive Approach

How to Enable

Get Started

Read previous post:

Read next post:

CloudSecurity

You may also like

Comments

CloudSecurity

Related Products

Security Center

Security Solution

Data Security Center (Original SDDP)

Security Overview