Code Linting: A Shift Left Strategy to Protect Your Codebase
July 22, 2021

Nicolas Bontoux
SonarSource

Delivering clean and safe software is no longer an option for developers or the organizations they work for. Customers have little patience for buggy, error-prone apps and software that's rife with critical vulnerabilities. These sort of quality and security issues can seriously hurt a company's brand reputation and negatively impact revenues.

Security has become a particular concern for developers. The majority of software security vulnerabilities are the result of coding errors, not malicious attacks. According to a recent analysis of over 500 Github security advisories from 2019-2020, 83% of advisories were caused by coding mistakes, while only 17% "were related to explicitly malicious behavior such as backdoor attempts."

Because of these factors, developers and development teams are continuously looking for ways to achieve cleaner and safer code. As a result, static analysis tools have begun to grow rapidly in popularity.

On a basic level, code linting software analyzes source code to flag issues during the development process and helps developers find and fix typos, programming errors, syntax, and bugs.

But is it enough?

No. That's why Developers are turning to modern day linters.

Modern day linters are becoming a must-have commodity in every developer's toolbox because of their advanced capabilities. Good linting tools not only perform basic checks, but are also capable of running static analysis to detect security vulnerabilities, memory leaks, code compliance, and more, right in the development environment. With developers taking more ownership of security, these features are critical.

Support for a Shift Left Approach

Bugs in production apps can wreak major havoc, exposing sensitive user data and jeopardizing a company's revenue and reputation. Detecting and fixing these bugs in pre-production is critical to avoiding these issues. It's also much easier and cheaper to correct coding errors during pre-production than it is once an app is in production. Aside from reducing the risk of end-user impact and protecting your brand's reputation, detecting issues earlier in the software pipeline can also reduce development costs and avoid delayed projects.

Developers can achieve this by adopting a shift left approach to software development — testing code, finding errors and fixing them as early as possible, often dynamically as you code (i.e. in your IDE using a "Clean as you Code" approach). These advanced linting tools ultimately support this shift left approach, allowing developers to detect issues earlier in the development cycle. Shifting left not only allows developers to deliver clean and safe code, but also improves the overall maintainability and reliability of their codebase. Moreover, these checks can be built into a team's development toolchain — so that bugs and security vulnerabilities can be prevented before an app is deployed to production.

Beyond Identifying Errors: Helping Developers Grow

Good linting tools need to do more than just identify syntax, style, bugs, or security issues — they must provide helpful cues on what the issues are, why they are harmful, and how they should be fixed. When a linter flags that a developer has made an error, it should offer context explaining the reasoning behind the rule that was broken, information on why it should be followed, provide helpful examples, and a rundown of what can go wrong if the rule isn't followed. Developers shouldn't change code simply because a linter told them to. They should change it because they've learned to do better.

With these insights, developers can learn from their mistakes, uncover new best practices to avoid those mistakes, master new programming languages faster, and code safer and better apps in the long run. This not only improves software quality, but boosts the efficiency of an organization's entire development team. As a result, organizations can reduce technical debt and spend more developer resources building new features rather than fixing flawed code.

For developers to learn from their mistakes, instant feedback is essential. Linting tools should flag any errors or quality issues while developers are writing code, providing more of an intuitive spell-checking or grammar checking experience. This real-time feedback makes it easier for developers to recognize mistakes and remember how to prevent them in the future.

This approach also supports better code ownership. When issues are raised as a developer adds new code, it's clear that person is responsible for fixing it. This avoids the confusion common in traditional testing methods, when errors aren't flagged until long after code is written and development teams have to manually review the codebase to determine what the appropriate next step is.

Conclusion

Modern code linters play a pivotal role in the development process, enabling developers to improve code quality and security, and should serve as more than just another testing or error monitoring tool. By Offering robust real-time insights, including detailed context for every issue flagged, clear guidance on fixing those issues and best practices for avoiding them, programmers get better at their job in the long term and enterprises will reap major benefits from improved developer skills and efficiency.

Nicolas Bontoux is VP Product Marketing at SonarSource
Share this

Industry News

June 29, 2022

Progress announced the latest release of Progress Flowmon.

June 29, 2022

CodeSee announced the launch of Open Source Hub (OSH).

June 29, 2022

Ambassador Labs announced the newest release of Ambassador Edge Stack, an integrated edge solution that empowers developer teams to quickly configure the edge services required to build, deliver, and scale applications for Kubernetes.

June 29, 2022

Ondat released into general availability version 2.8 of its Ondat platform for stateful workloads in Kubernetes.

June 28, 2022

Hewlett Packard Enterprise (HPE) unveiled platform enhancements and new cloud services for HPE GreenLake, the company’s flagship offering that enables organizations to modernize all their applications and data.

June 28, 2022

Sysdig announced Drift Control to prevent container attacks at runtime. Teams can detect, prevent, and speed incident response for containers that were modified in production, also known as container drift.

June 28, 2022

ShiftLeft announced an investment from and go-to-market partnership with Wipro Ventures.

June 27, 2022

Delinea announced the latest release of DevOps Secrets Vault.

June 27, 2022

Jit announced a $38.5 million seed funding round and launched a free beta version which automates product security.

June 27, 2022

Platform.sh raised $140 million in Series D funding.

June 23, 2022

Akana by Perforce now offers BlazeMeter to customers, previously a solution with Broadcom Layer7.

June 23, 2022

Coder announced the release of a new open source project that gives developers and data scientists a consistent, secure, yet flexible way to create cloud workspaces in minutes.

June 23, 2022

GitGuardian is announcing a series of new features to address developer experience in securing the software development lifecycle.

June 22, 2022

OctoML released a major platform expansion to accelerate the development of AI-powered applications by eliminating bottlenecks in machine learning deployment.

June 22, 2022

Snow Software announced new functionality and integrations for Snow Atlas, a purpose-built platform that provides a framework to accelerate data-driven technology decision-making.