---
id: wiki-2026-0508-ai-powered-code-analysis
title: AI-Powered Code Analysis (Autofix + Triage)
category: 10_Wiki/Topics
status: verified
canonical_id: self
aliases: [AI 코드 분석, Autofix, Triage, intelligent code analysis]
duplicate_of: none
source_trust_level: B
confidence_score: 0.85
verification_status: conceptual
tags: [ai-code-analysis, autofix, triage, sast, llm-engineering, devsecops]
raw_sources: [Datacollector_Export_2026-05-02]
last_reinforced: 2026-05-09
github_commit: pending
---

# AI-Powered Code Analysis (Autofix + Triage)

## 📌 한 줄 통찰
> **Pattern matching → LLM understanding**. 매 finding 의 confidence score + auto-fix + human review priority. **Triage (어느 거 먼저) + Autofix (수정 가능 한 거)**. SAST 의 모던 evolution.

## 📖 핵심

### 매 4 capability
1. **Detection**: 매 defect / vulnerability.
2. **Triage**: 매 priority (severity + exploitability).
3. **Explanation**: 매 issue 의 why + how to fix.
4. **Autofix**: 매 patch 의 generate.

### 매 limitation 의 traditional SAST
- 매 false positive 폭발.
- 매 alert fatigue.
- 매 context blindness.
- 매 manual triage.

### 매 LLM 의 advantage
- 매 context understanding.
- 매 false positive ↓.
- 매 actionable explanation.
- 매 auto-fix suggestion.

### Triage rule

#### Severity (CVSS)
- Critical (9-10): 매 immediate.
- High (7-8.9): 매 sprint.
- Medium (4-6.9): 매 backlog.
- Low (< 4): 매 ignore / batch.

#### Exploitability
- Reachable code path?
- User input 의 reach?
- Authentication bypass 가능?
- Production-impactful?

#### Business impact
- 매 critical service.
- 매 customer data.
- 매 financial.

→ 매 high × high = priority.

### Autofix 의 caveat

#### Confidence-based gating
- > 95%: auto-apply (low risk).
- 80-95%: PR comment.
- < 80%: discussion.

#### Verification
- Test 의 still pass.
- 매 logic 의 unchanged.
- 매 unintended side effect.

#### Rollback ready
- 매 fix 의 own commit.
- 매 revert easy.

### 매 tool

#### Snyk Code
- AI-augmented SAST.
- Deepcode 기반.
- 매 finding 의 actionable.

#### Sonar
- Quality + security.
- AI Code Assurance feature.

#### Corgea
- AI auto-fix focus.
- 매 vulnerability 의 patch.

#### CodeRabbit
- LLM PR review.
- 매 comment + suggestion.

#### Veracode
- Enterprise SAST.
- 매 false positive ↓.

### 매 production pattern

#### CI integration
- 매 PR 의 scan.
- 매 finding 의 triage.
- 매 autofix 의 separate PR.

#### IDE integration
- 매 keystroke 의 inline.
- 매 quick fix.

#### Periodic deep scan
- Weekly / monthly.
- 매 codebase-wide.

## 💻 Code

### Snyk Code (CI)
```yaml
- uses: snyk/actions/setup@master
- run: snyk code test --severity-threshold=high --json > snyk.json
- run: |
    HIGH_COUNT=$(jq '[.runs[].results[] | select(.level == "error")] | length' snyk.json)
    if [[ $HIGH_COUNT -gt 0 ]]; then
      echo "High severity found: $HIGH_COUNT"
      exit 1
    fi
```

### Custom AI triage (LLM-as-judge)
```python
async def triage_finding(finding):
    prompt = f"""
Triage this security finding.

Code:
```
{finding.code_snippet}
```

Pattern matched: {finding.rule_id}
Description: {finding.description}

Assess:
1. Reachability (1-10): is this code path reachable from user input?
2. Exploitability (1-10): can attacker actually exploit?
3. Business impact (1-10): customer-facing? financial?
4. Recommendation: fix now / fix sprint / ignore / false positive.

Output JSON.
"""
    return json.loads(await llm.complete(prompt))
```

### Autofix workflow
```python
class AutofixWorkflow:
    async def process(self, finding):
        triage = await self.triage(finding)
        
        if triage['recommendation'] == 'false_positive':
            return await self.dismiss(finding)
        
        # Generate fix
        fix = await self.generate_fix(finding)
        
        if fix['confidence'] > 0.95 and not fix['risky']:
            # Auto-apply (low-risk)
            await self.apply_fix(finding.file, fix)
            await self.create_pr(f"AI auto-fix: {finding.summary}", fix)
        elif fix['confidence'] > 0.8:
            # PR comment
            await self.comment_on_pr(finding.pr_id, finding.line, fix.suggestion)
        else:
            # Manual review
            await self.flag_for_human(finding)
```

### Generate fix (LLM)
```python
async def generate_fix(finding):
    prompt = f"""
Fix this security issue.

Code (line {finding.line}):
```
{finding.code_snippet}
```

Issue: {finding.description}

Generate:
1. Specific fix (code).
2. Confidence (0-1).
3. Risk: any unintended side effect?
4. Test: how to verify fix.

Output JSON.
"""
    return json.loads(await llm.complete(prompt))
```

### Test 후 fix verification
```python
async def verify_fix(file, fix):
    # Apply
    backup = read_file(file)
    apply(file, fix)
    
    # Test
    test_result = run_tests()
    
    if test_result.passed:
        commit(f"AI fix: {fix.summary}")
        return True
    else:
        # Rollback
        write_file(file, backup)
        return False
```

### Triage queue (Linear / Jira)
```python
async def to_linear(finding):
    issue = await linear.issues.create({
        'title': f"[Security] {finding.summary}",
        'description': format_finding(finding),
        'priority': triage_to_priority(finding.triage),
        'labels': ['security', 'ai-triaged'],
        'assignee': pick_assignee(finding),
    })
    return issue
```

### Dashboard
```python
def dashboard_metrics():
    return {
        'open_critical': db.findings.count(severity='critical', state='open'),
        'mean_triage_time': db.findings.avg_triage_time(),
        'autofix_rate': db.findings.autofix_count() / db.findings.count(),
        'false_positive_rate': db.findings.fp_count() / db.findings.count(),
    }
```

## 🤔 결정 기준

| Finding | Action |
|---|---|
| Critical + reachable | 매 immediate fix |
| High + exploitable | 매 sprint |
| Medium + complex | 매 review + plan |
| Low + edge case | 매 ignore / batch |
| AI 의 high confidence fix | Auto-apply |
| AI 의 low confidence | Comment + human |

**기본값**: SAST + LLM triage + autofix 의 confidence-based gating.

## 🔗 Graph
- 부모: [[AI_코드_리뷰]] · [[SAST]] · [[CI_CD 파이프라인 및 IDE 통합 보안|DevSecOps]]
- 변형: [[Snyk-Code]] · [[CodeRabbit]]
- 응용: [[AI-Code-Assurance]]
- Adjacent: [[AI 기반 코드 분석 도구 (AI-Powered Code Analysis Tools)]]

## 🤖 LLM 활용
**언제**: 매 large codebase 의 vulnerability triage. 매 alert fatigue 의 reduce.
**언제 X**: 매 small project (overkill). 매 specific compliance audit (auditor).

## ❌ 안티패턴
- **Auto-apply low confidence**: bug 의 production.
- **No verification**: regression.
- **No rollback plan**: stuck.
- **All findings 의 same priority**: triage missing.
- **Trust AI 의 100% fix**: hallucination.

## 🧪 검증 / 중복
- Verified.
- 신뢰도 B.
- Related: [[AI_코드_리뷰]] · [[AI-Code-Assurance]] · [[AI 기반 코드 분석 도구 (AI-Powered Code Analysis Tools)]].

## 🕓 Changelog
| 날짜 | 변경 |
|---|---|
| 2026-05-08 | Phase 1 |
| 2026-05-09 | Manual cleanup — 4 capability + triage + autofix workflow + code |
