Developer tasks

Using the Agent wizard is the simplest way to deploy a new agent in Northstar.

AppSec or a SOC Analyst assigns incidents to you from the Incidents page by setting Assigned to your name. You may also see issues surfaced to you directly if your organization routes findings that way. Either path, this is your notification that a task needs your attention.

Open the issue and start with the Overview tab: severity, status, when it was first and last detected, the rule that triggered it, and Contrast's How to fix guidance, including details from Contrast Intelligent Remediation and any available runbooks.

The Evidence tab goes deeper, showing the data flow, string operations, and stack traces that led Contrast to flag it in the first place, which is usually enough to locate the exact line causing the problem.

For CVE and library issues, the CVEs tab shows the affected library, the CVE Shield status, and the environment where it was found, and Explorer can show you the full dependency path from your code to the vulnerable library.

Where SmartFix is set up on your repository, you may not need to write the fix at all. SmartFix is an AI agent that generates code fixes for issues Contrast's static and runtime analysis identify, working through GitHub Actions to open a pull request with the proposed change. It uses the same runtime context you'd use yourself: attack surface, full data flow, stack traces, HTTP requests, existing defenses, and available libraries, so the fix it proposes fits the code it's actually looking at.

Your organization can configure a build command (and optionally a formatting command) so SmartFix validates that its own change builds and passes tests before opening the PR. You review and merge it like any other pull request. Once it's merged, the issue's Activity tab logs the SmartFix action and a link to the PR, and the issue's status updates to SmartFix Remediated.

Merging a fix isn't quite the end of your part. AppSec or SOC will monitor the issue and any associated incidents to confirm the vulnerability isn't still being triggered before they close it out, so keep an eye out if they come back to you with something that didn't fully resolve.