--- schema: 1 type: video title: 'SonarQube + OpenAI: Agentic Development — Killian Carlsen-Phelan, Sonar' description: >- A tiny Python project contains a hardcoded API key, a SQL injection path and other deliberately planted issues. Killian Carlsen-Phelan runs it through SonarQube, brings the findings into Codex and asks the agent to fix the vulnerable query. The scan follows user controlled input into database execution; the repair replaces string interpolation with a parameterized query. A verification hook checks the edited code again, putting the security feedback inside the coding loop rather than leaving it for a later failed build or review. The workshop develops Sonar's guide, verify and solve workflow through a live setup of SonarQube Cloud, its CLI, plugin and MCP server. A secrets detection hook blocks a fake credential in a prompt, while an issue listing skill gives the agent evidence from the project dashboard. Context augmentation supplies coding guidance before generation, and agentic analysis checks edits as they happen. The opening OpenAI introduction separates execution containment from artifact correctness and defines completion through a reviewable change and independent evidence. Questions explore how the hooks can be bypassed, which steps run locally or in a container, and which features depend on organizational access. Killian finishes by adding a new database operation under the same verification loop, showing how the setup supports both fixing existing issues and checking new work. Speaker info: - https://www.linkedin.com/in/kcarlsen2 - https://github.com/SonarSource/sonarqube-cli Timestamps: 0:00 - Completion requires evidence 2:44 - Containment and correctness 3:56 - Feedback inside the agent loop 5:46 - Killian and the workshop setup 8:17 - Guide, verify, and solve 9:40 - Move verification into the IDE 12:11 - Provision the sample project 14:06 - Deliberately planted issues 16:14 - Secrets and SQL injection 18:05 - Follow the vulnerable data flow 20:09 - Inspect the SonarQube dashboard 21:52 - Install the Codex plugin 23:19 - Authenticate and integrate the CLI 25:21 - Hooks, skills, and configuration 27:12 - Block a fake secret 28:08 - Hook boundaries and bypass questions 29:00 - MCP and issue listing 32:10 - Local configuration and Docker 34:12 - Access and feature entitlements 35:09 - Fix the SQL injection finding 37:04 - Verify the parameterized query 38:28 - Add a new database operation 40:34 - Community resources and wrap up --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/bI8WyG9YB0I-youtube-4425a1141a8cf569d6ee Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- canonical: 'https://liquidgold.cc/watch/bI8WyG9YB0I' markdown: 'https://liquidgold.cc/watch/bI8WyG9YB0I.md' llms: 'https://liquidgold.cc/watch/bI8WyG9YB0I/llms.txt' parent: 'https://liquidgold.cc/channel/aidotengineer.md' channel: aidotengineer updated: '2026-10-23T22:24:30.017Z' language: null children: [] videoId: bI8WyG9YB0I durationSeconds: 2518 publishedAt: '2026-10-11T19:00:11.000Z' searchChunks: - ordinal: 0 text: null startSeconds: 24 endSeconds: 171 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=24' heldReason: rights - ordinal: 1 text: null startSeconds: 24 endSeconds: 171 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=24' heldReason: rights - ordinal: 2 text: null startSeconds: 24 endSeconds: 171 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=24' heldReason: rights - ordinal: 3 text: null startSeconds: 171 endSeconds: 183 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=171' heldReason: rights - ordinal: 4 text: null startSeconds: 183 endSeconds: 240 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=183' heldReason: rights - ordinal: 5 text: null startSeconds: 240 endSeconds: 251 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=240' heldReason: rights - ordinal: 6 text: null startSeconds: 251 endSeconds: 353 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=251' heldReason: rights - ordinal: 7 text: null startSeconds: 366 endSeconds: 499 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=366' heldReason: rights - ordinal: 8 text: null startSeconds: 512 endSeconds: 589 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=512' heldReason: rights - ordinal: 9 text: null startSeconds: 599 endSeconds: 740 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=599' heldReason: rights - ordinal: 10 text: null startSeconds: 751 endSeconds: 846 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=751' heldReason: rights - ordinal: 11 text: null startSeconds: 856 endSeconds: 980 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=856' heldReason: rights - ordinal: 12 text: null startSeconds: 991 endSeconds: 1093 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=991' heldReason: rights - ordinal: 13 text: null startSeconds: 1093 endSeconds: 1103 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=1093' heldReason: rights - ordinal: 14 text: null startSeconds: 1103 endSeconds: 1209 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=1103' heldReason: rights - ordinal: 15 text: null startSeconds: 1326 endSeconds: 1404 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=1326' heldReason: rights - ordinal: 16 text: null startSeconds: 1404 endSeconds: 1415 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=1404' heldReason: rights - ordinal: 17 text: null startSeconds: 1535 endSeconds: 1635 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=1535' heldReason: rights - ordinal: 18 text: null startSeconds: 1647 endSeconds: 1690 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=1647' heldReason: rights - ordinal: 19 text: null startSeconds: 1740 endSeconds: 1751 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=1740' heldReason: rights - ordinal: 20 text: null startSeconds: 1936 endSeconds: 1948 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=1936' heldReason: rights - ordinal: 21 text: null startSeconds: 2058 endSeconds: 2068 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=2058' heldReason: rights - ordinal: 22 text: null startSeconds: 2116 endSeconds: 2127 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=2116' heldReason: rights - ordinal: 23 text: null startSeconds: 2234 endSeconds: 2246 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=2234' heldReason: rights - ordinal: 24 text: null startSeconds: 2312 endSeconds: 2323 watch: 'https://liquidgold.cc/watch/bI8WyG9YB0I?t=2312' heldReason: rights --- # SonarQube + OpenAI: Agentic Development — Killian Carlsen-Phelan, Sonar A tiny Python project contains a hardcoded API key, a SQL injection path and other deliberately planted issues. Killian Carlsen-Phelan runs it through SonarQube, brings the findings into Codex and asks the agent to fix the vulnerable query. The scan follows user controlled input into database execution; the repair replaces string interpolation with a parameterized query. A verification hook checks the edited code again, putting the security feedback inside the coding loop rather than leaving it for a later failed build or review. The workshop develops Sonar's guide, verify and solve workflow through a live setup of SonarQube Cloud, its CLI, plugin and MCP server. A secrets detection hook blocks a fake credential in a prompt, while an issue listing skill gives the agent evidence from the project dashboard. Context augmentation supplies coding guidance before generation, and agentic analysis checks edits as they happen. The opening OpenAI introduction separates execution containment from artifact correctness and defines completion through a reviewable change and independent evidence. Questions explore how the hooks can be bypassed, which steps run locally or in a container, and which features depend on organizational access. Killian finishes by adding a new database operation under the same verification loop, showing how the setup supports both fixing existing issues and checking new work. Speaker info: - https://www.linkedin.com/in/kcarlsen2 - https://github.com/SonarSource/sonarqube-cli Timestamps: 0:00 - Completion requires evidence 2:44 - Containment and correctness 3:56 - Feedback inside the agent loop 5:46 - Killian and the workshop setup 8:17 - Guide, verify, and solve 9:40 - Move verification into the IDE 12:11 - Provision the sample project 14:06 - Deliberately planted issues 16:14 - Secrets and SQL injection 18:05 - Follow the vulnerable data flow 20:09 - Inspect the SonarQube dashboard 21:52 - Install the Codex plugin 23:19 - Authenticate and integrate the CLI 25:21 - Hooks, skills, and configuration 27:12 - Block a fake secret 28:08 - Hook boundaries and bypass questions 29:00 - MCP and issue listing 32:10 - Local configuration and Docker 34:12 - Access and feature entitlements 35:09 - Fix the SQL injection finding 37:04 - Verify the parameterized query 38:28 - Add a new database operation 40:34 - Community resources and wrap up --- Watch along with the corrected transcript, summary, timestamps and resources on this talk's official AIE page: https://ai.engineer/talks/bI8WyG9YB0I-youtube-4425a1141a8cf569d6ee Join our upcoming AI Engineer conferences (see https://ai.engineer landing page): - AIEi Shanghai, November 5–6 — the first for meeting top Chinese labs and engineers - AIE CODE in SF, November 10–12 — the top AI Coding conference returns - AIEi Sydney, December 7–8 — the first AIEi run alongside NeurIPS 2026 in Sydney --- Canonical: https://liquidgold.cc/watch/bI8WyG9YB0I · Channel: [AI Engineer](https://liquidgold.cc/channel/aidotengineer.md) > Search chunk text is held until public-source provenance is verified. ## Document chunks > Missing: no stored document chunks are available.