HCL AppScan CodeSweep

HCL AppScan CodeSweep is a developer-first, lightweight application security and software composition analysis extension designed to catch code flaws and vulnerable open-source dependencies directly inside popular integrated development environments (IDEs) as developers write code. Built to enable authentic shift-left security, CodeSweep operates natively within developer workflows, highlighting security weaknesses in real time and providing clear, actionable remediation tips before code is committed to version control repositories.

The extension provides fast, local scanning that analyzes source code files and package manifests upon file save without sending proprietary code to external third-party servers. Key technical capabilities include static analysis of security vulnerabilities across multiple languages (Python, JavaScript, Java, Go, C#, etc.), automated Software Composition Analysis (SCA) that identifies vulnerable third-party packages, automated scanning of container files and Infrastructure as Code (IaC) templates, and direct links to AppScan fix guidance. By providing non-intrusive, immediate security feedback, CodeSweep educates software engineers on secure coding practices while preventing vulnerabilities from entering CI/CD build pipelines.

HCL AppScan CodeSweep integrates directly as a plugin for Visual Studio Code, IntelliJ IDEA, and GitHub Actions (via the CodeSweep GitHub Action). Common use cases include providing developers with continuous local security linting, vetting open-source dependencies before importing them into codebases, auditing pull requests automatically in GitHub, and reducing downstream AppSec triage backlogs. HCL AppScan CodeSweep provides frictionless developer usability, zero cost for community users, and instant security feedback at the point of creation.