🍪 Your Privacy Matters

We use cookies to enhance your experience. Essential cookies are required for the site to work. You can customize your preferences for analytics and marketing cookies.

CodeDD Logo
Book a demo
DocumentationSoftware AuditAI-Powered File Analysis

AI-Powered File Analysis

How CodeDD's multi-agent AI system analyzes your code

AI-Powered File Analysis

Overview

CodeDD's AI analysis stage is where the intelligence happens. Using specialized AI agents, every selected file is analyzed for architecture, security, technical debt, and quality—providing insights that traditional static analysis tools miss.

What Makes It Different

Beyond Traditional SAST

Traditional Static Analysis:

  • Pattern matching against known vulnerabilities
  • Limited to syntactic analysis
  • High false positive rates
  • Misses architectural issues

CodeDD's AI Analysis:

  • Context-Aware: Understands business logic across files
  • Intent-Based: Identifies what developers tried to do vs. what code actually does
  • Architecture-Aware: Recognizes design patterns and anti-patterns
  • Multi-Agent Verification: Cross-validates findings to eliminate false positives

Analysis Architecture

Concurrent Processing Pipeline

CodeDD processes files using a sophisticated concurrent architecture:

Stage 1: AI Auditing (Concurrent)

  • 10 concurrent AI agent workers
  • Rate-limited to respect API quotas (100 calls/minute)
  • In-memory processing for speed
  • Files queued for analysis

Stage 2: Batch Database Writes (Sequential)

  • Single-threaded database writer
  • Processes results in batches of 5
  • Prevents database lock contention
  • Ensures data consistency

Why This Architecture:

  • High Throughput: AI analysis is CPU-intensive; parallelization maximizes speed
  • Data Integrity: Sequential writes avoid database conflicts
  • Graceful Degradation: Failed files don't block others
  • Resource Efficient: Balanced CPU and I/O utilization

What Gets Analyzed

Source Code Files

Application Code:

  • Business logic and algorithms
  • API endpoints and controllers
  • Database queries and ORM usage
  • Authentication and authorization logic
  • Data validation and sanitization
  • Error handling patterns

Infrastructure Code:

  • Dockerfile and container configurations
  • Kubernetes manifests and Helm charts
  • CI/CD pipeline definitions
  • Infrastructure-as-Code (Terraform, CloudFormation)

Configuration Files:

  • Application configuration
  • Environment variables
  • Feature flags
  • Third-party integrations

File Selection

Not all files require deep AI analysis. CodeDD intelligently selects files based on:

Priority Criteria:

  • Files marked as selected_for_audit: true in database
  • Security-critical files (authentication, authorization)
  • Core business logic
  • Recently modified files
  • High complexity files
  • Configuration files with security implications

Excluded from AI Analysis:

  • Auto-generated code
  • Minified files
  • Binary files
  • Very large files (>50k LOC) may be sampled
  • Test fixtures and mock data

AI Agent Capabilities

Code Understanding

Semantic Analysis:

  • Understands code intent beyond syntax
  • Identifies logical errors and edge cases
  • Recognizes business logic vulnerabilities
  • Detects subtle security issues

Cross-File Context:

  • Tracks data flow across files
  • Identifies missing validations
  • Recognizes architectural patterns
  • Detects inconsistent implementations

Issue Detection

Security Vulnerabilities:

  • SQL injection points
  • Cross-site scripting (XSS) vectors
  • Authentication bypasses
  • Authorization flaws
  • Insecure cryptography
  • Secrets in code
  • Sensitive data exposure

Architecture Issues:

  • Tight coupling
  • Circular dependencies
  • God classes/objects
  • Missing abstraction layers
  • Inconsistent patterns

Technical Debt:

  • Code duplication
  • Overly complex functions
  • Missing error handling
  • Inadequate logging
  • Dead code

Quality Issues:

  • Poor naming conventions
  • Missing documentation
  • Inconsistent style
  • Magic numbers
  • Hard-coded values

Confidence Scoring

Every finding includes a confidence score:

High Confidence (90-100%):

  • Clear, unambiguous issues
  • Verified by multiple checks
  • Well-established patterns

Medium Confidence (70-89%):

  • Likely issues requiring context
  • May have legitimate use cases
  • Recommend manual review

Low Confidence (50-69%):

  • Potential issues
  • Requires domain expertise to validate
  • Informational findings

Example AI Analysis Output

📊 Example: Excellent File Analysis

Below is an example of what CodeDD's AI analysis produces for a typical file:

Overview

  • Script Purpose: Authentication middleware handling JWT token validation for API requests
  • Domain: Backend Security
  • Recommendation: Consider implementing rate limiting for failed authentication attempts and adding token refresh mechanism

Code Quality Assessment 🟢 Excellent

  • Readability: Highly readable 🟢
  • Consistency: Highly consistent 🟢
  • Modularity: Excellent 🟢
  • Maintainability: High 🟢
  • Reusability: High 🟢
  • Technical Debt: Low 🟡
  • Code Smells: None 🟢
  • Redundancy: No redundancies 🟢

Functionality Analysis 🟢 Strong

  • Completeness: Fully functional 🟢
  • Edge Cases: Excellently covered 🟢
  • Error Handling: Robust 🟢

Performance & Scalability 🟡 Good

  • Efficiency: High 🟢
  • Scalability: Moderate 🟡
  • Resource Utilization: Optimal 🟢
  • Parallel Processing: Partially supported 🟡
  • Database Interaction: Optimized 🟢
  • Concurrency Management: Adequate 🟡

Security Analysis 🟢 Strong

  • Input Validation: Strong 🟢
  • Data Handling: Secure 🟢
  • Authentication: Robust 🟢
  • Flag Status: Green 🟢
  • Security Concerns: No critical issues identified

Compatibility 🟢 Excellent

  • Platform Independence: Multi-platform 🟢
  • Integration: Seamless 🟢

Documentation 🟡 Adequate

  • Inline Comments: Adequate 🟡

Standards & Best Practices 🟢 Strong

  • Standards Compliance: Fully compliant 🟢
  • Design Patterns: Extensive use of patterns 🟢
  • Code Complexity: Low 🟢
  • Refactoring Opportunities: Few opportunities 🟢

Legend:

  • 🟢 Green (90-100): Excellent, no action needed
  • 🟡 Yellow (66-89): Good, minor improvements recommended
  • 🟠 Orange (33-65): Moderate issues, attention needed
  • 🔴 Red (0-32): Critical issues, immediate action required

⚠️ Example: File with Critical Issues

Here's an example analysis of a file requiring immediate attention:

Overview

  • Script Purpose: Payment processing handler for credit card transactions
  • Domain: Backend Payment Processing
  • Recommendation: URGENT - Fix SQL injection vulnerability and add input validation before production deployment

Code Quality Assessment 🔴 Poor

  • Readability: Moderately readable 🟡
  • Consistency: Somewhat inconsistent 🟡
  • Modularity: Poor 🔴
  • Maintainability: Low 🔴
  • Reusability: Low 🔴
  • Technical Debt: High 🔴
  • Code Smells: High 🔴
  • Redundancy: High redundancy 🔴

Functionality Analysis 🟠 Moderate

  • Completeness: Partially functional 🟠
  • Edge Cases: Poorly covered 🔴
  • Error Handling: Poor 🔴

Performance & Scalability 🟠 Needs Improvement

  • Efficiency: Average 🟡
  • Scalability: Not scalable 🔴
  • Resource Utilization: Excessive 🔴
  • Database Interaction: Inefficient 🔴

Security Analysis 🔴 Critical Issues

  • Input Validation: Weak 🔴
  • Data Handling: Insecure 🔴
  • Authentication: Non-existent 🔴
  • Flag Status: Red 🔴
  • Security Concerns:
    • SQL injection vulnerability detected (line 45)
    • Hardcoded credentials found (line 12)
    • Sensitive data logged in plaintext (line 78)
    • No authentication on payment endpoint

Compatibility 🟡 Limited

  • Platform Independence: Limited platforms 🟡
  • Integration: Requires workarounds 🟡

Documentation 🔴 Insufficient

  • Inline Comments: None 🔴

Standards & Best Practices 🔴 Non-Compliant

  • Standards Compliance: Non-compliant 🔴
  • Design Patterns: None 🔴
  • Code Complexity: High 🔴
  • Refactoring Opportunities: Many 🟢

AI-Detected Vulnerabilities:

  1. Critical: SQL injection in payment query (Confidence: 95%)
  2. Critical: Hardcoded database credentials (Confidence: 100%)
  3. High: Sensitive payment data logged (Confidence: 92%)
  4. High: Missing authentication on public endpoint (Confidence: 98%)
  5. Medium: Excessive database connections (Confidence: 85%)

Recommended Actions:

  1. Immediate: Remove hardcoded credentials, use environment variables
  2. Immediate: Implement parameterized queries to prevent SQL injection
  3. Urgent: Add authentication/authorization to payment endpoints
  4. Urgent: Remove sensitive data from logs, implement proper logging
  5. High Priority: Refactor for better error handling and modularity

Concurrent Analysis Process

Step 1: File Decryption

Files are decrypted on-the-fly:

  1. Read encrypted file from disk
  2. Decrypt in memory using audit-specific key
  3. Content never written back to disk unencrypted
  4. Memory cleared after analysis

Step 2: AI Processing

Each file is sent to AI agent:

  • File content and metadata provided
  • Context about file type and purpose
  • Previous findings for consistency
  • Language-specific analysis rules

AI Agent Response Time:

  • Simple files: 2-5 seconds
  • Complex files: 10-30 seconds
  • Rate limiting ensures stability

Step 3: Result Validation

AI findings are validated:

  • Schema validation (ensures proper structure)
  • Confidence score calculation
  • Deduplication against previous findings
  • Priority assignment

Step 4: Batch Storage

Results are queued and written in batches:

  • 5 files per database transaction
  • Each file isolated in transaction
  • Failed writes don't affect other files
  • Automatic retry with exponential backoff

SonarQube Integration (Optional)

Complementary Analysis

CodeDD can integrate with SonarQube for additional coverage:

When Enabled:

  1. Selected files decrypted to temporary workspace
  2. SonarScanner runs in isolated Docker container
  3. Results fetched via SonarQube API
  4. Issues stored alongside AI findings
  5. Temporary workspace securely deleted

What SonarQube Adds:

  • Language-specific linting rules
  • Code smell detection
  • Cyclomatic complexity
  • Duplication detection
  • Security hotspots

Architecture:

Docker Container: SonarScanner
  ├── Mounted: Temporary workspace (encrypted)
  ├── Network: Isolated (codedd-network)
  ├── Execution: Scan all files
  └── Output: CE Task ID
        ↓
Poll SonarQube API
  ├── Wait for analysis completion
  ├── Fetch issues (paginated)
  ├── Map issues to original file paths
  └── Store in TypeDB

Security:

  • SonarQube runs in isolated network
  • Source code never leaves CodeDD infrastructure
  • Results linked to encrypted file references
  • Container destroyed after analysis

Dependency Analysis

Package Discovery

For each file, CodeDD identifies dependencies:

Languages Supported:

  • JavaScript/TypeScript: package.json, npm, yarn
  • Python: requirements.txt, pipenv, poetry
  • Java: pom.xml, build.gradle
  • Ruby: Gemfile
  • Go: go.mod
  • PHP: composer.json
  • Rust: Cargo.toml
  • .NET: packages.config, .csproj

Vulnerability Scanning

Dependencies are checked against:

  • CVE Database: Known vulnerabilities
  • NVD: National Vulnerability Database
  • GitHub Advisory: Security advisories
  • OSV: Open Source Vulnerabilities

For Each Dependency:

  • Version detection
  • Vulnerability lookup
  • Severity assessment (Critical, High, Medium, Low)
  • Patch availability
  • Upgrade recommendations

License Compliance

Dependencies checked for license issues:

  • License type identification
  • GPL/copyleft detection
  • Commercial license conflicts
  • Missing license warnings

Cyclomatic Complexity

Measuring Code Complexity

CodeDD calculates cyclomatic complexity for functions:

What It Measures:

  • Number of independent paths through code
  • Branching complexity (if/else, switch, loops)
  • Error handling paths

Thresholds:

  • 1-10: Simple, easy to maintain
  • 11-20: Moderate complexity
  • 21-50: High complexity, refactoring recommended
  • 50+: Very high, significant technical debt

Why It Matters:

  • High complexity = higher bug likelihood
  • Harder to test thoroughly
  • Difficult to maintain and modify
  • Risk indicator for investors

Performance & Scale

Processing Speed

Typical Performance:

  • Small Repos (<100 files): 5-10 minutes
  • Medium Repos (100-1,000 files): 15-45 minutes
  • Large Repos (1,000-10,000 files): 1-3 hours
  • Very Large (10,000+ files): 3-8 hours

Factors Affecting Speed:

  • File count and size
  • API rate limits
  • Network latency
  • Database write speed
  • Concurrent workers available

Resource Management

Memory Usage:

  • Streaming file processing
  • Results written incrementally
  • Memory cleared after each file
  • Typical peak: 2-4GB

CPU Utilization:

  • 10 concurrent AI workers
  • Additional threads for I/O
  • Scales with available cores

Error Handling & Resilience

Graceful Degradation

File-Level Failures:

  • Individual file errors logged
  • Other files continue processing
  • Partial audit results still valuable

Common Scenarios:

  • API Timeouts: Automatic retry (3 attempts)
  • Malformed Code: Logged, skipped, audit continues
  • Rate Limiting: Automatic backoff and retry
  • Database Errors: Transaction rollback, retry batch

Success Metrics

Audit is considered successful if:

  • >80% of files analyzed successfully
  • Critical files (security, config) analyzed
  • Dependency scan completed
  • Results stored in database

Data Privacy

Zero Code Retention

Critical Security Guarantee:

After AI analysis:

  1. File content never stored in database
  2. AI API calls use ephemeral processing
  3. Results stored (findings only, not code)
  4. Original files remain encrypted
  5. Memory cleared after analysis

What We Store:

  • File paths and metrics
  • AI findings and recommendations
  • Dependency lists
  • Vulnerability details
  • Complexity scores

What We Never Store:

  • Actual source code
  • Secrets or credentials (if detected, flagged but not stored)
  • PII from code comments
  • Business logic implementation details

Key Takeaways

For Investors:

  • AI analysis identifies risks traditional tools miss
  • Confidence scoring helps prioritize findings
  • Dependency vulnerabilities quantified
  • Technical debt measured objectively

For CTOs:

  • Deep semantic analysis, not just pattern matching
  • Architecture issues identified early
  • Actionable remediation guidance
  • Benchmarking against industry standards

Next Steps

Was this page helpful?

Still need help? Contact support