HCL AppScan

Overview

HCL AppScan for Eclipse brings enterprise-grade application security testing capabilities directly into the Eclipse IDE. This plugin connects seamlessly to HCL AppScan on Cloud and HCL AppScan 360°, enabling development teams to identify, prioritize, and remediate security vulnerabilities without leaving their development environment. With version 2.1.0, the plugin introduces CodeSweep — a local SAST scanner that delivers instant, real-time security feedback on every file save — along with training links in the How to Fix view and interactive data flow visualization in the Issue Details view.

What's New in 2.1.0

CodeSweep — Local Static Analysis on Save

• Instant Scan on Save: Automatically scan the active file for security vulnerabilities every time you save — no cloud connection required.
• Auto-Fix Suggestions: Receive actionable code fix suggestions directly in the findings table, and select and apply recommended fixes instantly.
• Noise Marking: Mark false-positive findings as noise to keep your results clean; these are persisted across sessions via Eclipse preferences.
• Language Rule Management: Open the dedicated CodeSweep Rules View to browse, enable, or disable scanning rules by language category.
• Welcome Experience: Learn CodeSweep capabilities and get started quickly with a guided onboarding screen.
• Standalone Operation: Run CodeSweep as a local service — no AppScan account or internet connection needed for local scanning.

Training Links in How to Fix Guidance

• Integrated Security Training: Access embedded training links directly within the "How to Fix" remediation guidance (when enabled for your tenant) to connect with relevant security training courses.
• Tenant-Level Configuration: Enable training links automatically based on your organization's AppScan on Cloud / AppScan 360° tenant settings — no manual configuration required.
• Contextual Learning: Receive targeted educational content alongside remediation examples, tailored to the specific vulnerability type.
• Available in CodeSweep: View training links in the guidance view when browsing CodeSweep findings and rules, enabling continuous learning even during local scanning.

Interactive Data Flow in Issue Details

• Visual Trace Tree: View the complete data flow path from source to sink as an interactive, expandable tree structure.
• Legend Bar: Quickly identify the best fix location, alternative fix location, source, sink, taint propagator, and tainted data nodes via color-coded icons.
• Click-to-Navigate: Click any trace node to open the corresponding file at the exact line in the Eclipse editor.
• Theme-Aware Rendering: Adapt seamlessly to Eclipse light and dark themes with dedicated CSS styling.
• XSL Transformation: Render client-side trace XML from the API into rich, interactive HTML for fast performance.

Key Features

Comprehensive Security Visibility

• Intelligent Fix Groups: Streamline remediation by organizing security findings into Fix Groups based on common fix locations, API calls, or vulnerability types.
• Unified Scan Results: Access complete scan results from Static Application Security Testing (SAST) and Software Composition Analysis (SCA) in a single view.
• Real-Time Synchronization: Automatically synchronize security findings from AppScan on Cloud and AppScan 360° into your Eclipse workspace.
• Multi-Application Support: Switch between multiple applications using a searchable drop-down menu and intelligent filtering.

Developer-Centric Workflow

• Direct Source Navigation: Navigate from a security finding to the exact file and line number in the source code with a single click.
• Integrated Triage: Update issue statuses (Open, In Progress, Noise, Fixed, Passed), add comments and apply sticky status options directly from the IDE.
• Severity-Based Prioritization: Focus on critical issues first using clear, color-coded severity indicators (Critical, High, Medium, Low, Informational).
• Deep Issue Analysis: View comprehensive issue details, including interactive data flow paths, sink locations, and risk assessment.

CodeSweep — Local SAST Scanner

• Scan on Save: Automatically triggers a local security scan each time a file is saved in the workspace.
• No Account Required: Works without an AppScan on Cloud or AppScan 360° connection — ideal for offline or early-stage development.
• Multi-Language Support: Scans across multiple programming languages with configurable rule sets.
• Auto-Fix Integration: Provides suggested code fixes with a drop-down selector to apply them directly.
• Noise Management: Persistently mark findings as false positives to reduce clutter in subsequent scans.
• Rules Configuration: Manage scanning rules per language via the CodeSweep Rules View.

Built-In Remediation Guidance

• "How To Fix" View: Access embedded browser-based guidance featuring language-specific remediation examples and security best practices.
• Training Links: When enabled for your tenant, remediation guidance includes direct links to security training courses relevant to the specific vulnerability type.
• Interactive Data Flow Visualization: Trace the path of potentially dangerous data through the application via an expandable, clickable trace tree in the Issue Details view.
• Secure Code Examples: Copy and implement ready-to-use code snippets to resolve security issues quickly.
• Adaptive Theme Support: The interface automatically adapts to light or dark themes for optimal readability.

Professional Reporting

• On-Demand Reporting: Generate comprehensive security reports directly from Eclipse.
• Regulatory Compliance: Create compliance-focused reports for standards including PCI-DSS, HIPAA, GDPR.
• Custom Configurations: Select specific scans, configure report types, and customize output formats to meet project needs.
• Automated Retrieval: The plugin automatically downloads reports for immediate viewing upon generation.

Intuitive User Interface

• Dedicated Perspective: Utilize a pre-configured layout optimized for security analysis workflow.
• Tabbed Navigation: Organize work efficiently with tabs for Fix Groups, Scans, Issues, and CodeSweep findings.
• Smart Search: Filter applications by name with real-time results.
• Interactive Data Tables: Explore data efficiently using sortable columns, tooltips, and clickable links.
• Welcome Experience: Get started quickly with a guided onboarding screen featuring quick access to sign-in and documentation.

Flexible Authentication

• API Key Security: Connect securely using HCL AppScan API keys.
• Multi-Environment Support: Connect to different instances, including AppScan on Cloud and on-premise AppScan 360° deployments.

Benefits

For Developers

• Maintain Focus: Eliminate context switching by managing security within the IDE.
• Get Instant Feedback: CodeSweep provides immediate vulnerability detection on every file save.
• Accelerate Remediation: Utilize direct code navigation and inline guidance to fix issues faster.
• Learn While You Fix: Training links in the How to Fix view connect you to relevant security courses for deeper understanding.
• Master Secure Coding: Learn security best practices while fixing real-world issues.
• Reduce Noise: Mark false positives as "Noise" or "Not Applicable" to clear the queue.

For Security Teams

• Enable Self-Service: Empower developers to access and triage issues independently.
• Shift Left Early: CodeSweep catches vulnerabilities before code is even committed.
• Drive Training Adoption: Embedded training links in remediation guidance encourage developers to complete security training in context.
• Unify Communication: Maintain shared visibility into security status across development and security teams.
• Monitor Velocity: Track issue status updates and remediation progress in real time.
• Scale Operations: Integrate more developers into the security process without increasing security headcount.

For Organizations

• Mitigate Risk: Identify and remediate vulnerabilities earlier in the SDLC.
• Lower Costs: Reduce technical debt by fixing security issues during development rather than production.
• Ensure Compliance: Meet regulatory requirements with consistent, comprehensive security testing.
• Enhance Quality: Build security directly into the software quality assurance process.

System Requirements

Before installing the plugin, ensure your environment meets the following prerequisites:

• Eclipse IDE: Version 2025-06 or later
• Java Runtime: JRE/JDK 21 or later
• Operating Systems: Windows 10/11, macOS 12+, Linux
• Display Resolution: Optimized for 1920 x 1080 resolution for the best user experience
• Internet Connection: Required for connecting to HCL AppScan on Cloud or HCL AppScan 360° (not required for CodeSweep local scanning)
• HCL AppScan Account: Valid API key for HCL AppScan on Cloud or HCL AppScan 360° (not required for CodeSweep local scanning)

Getting Started

Follow these steps to install the plugin, connect to the HCL AppScan service, and start managing vulnerabilities.

1. Install the plugin Install using one of the following methods:
   • Drag and Drop: Drag the Install button from the Eclipse Marketplace listing directly into your running Eclipse workspace (requires the Eclipse Marketplace Client to be installed).
   • Update Site: In Eclipse, navigate to Help > Install New Software…, enter the update site URL https://eclipseplugins.z20.web.core.windows.net, select the HCL AppScan feature, and follow the installation wizard prompts.
2. Configure the connection
   
   1. Open the AppScan perspective (Window > Perspective > Open Perspective > HCL AppScan).
   2. Click Login.
   3. Enter the HCL AppScan URL and valid API credentials.
3. Select an application
   
   1. Select the target application from the drop-down list.
   2. View the associated Fix Groups and Scans in the tabbed interface.
4. Start fixing
5. Click a Fix Group to view related issues.
   
   2. Click on the Location of Fix to navigate to the vulnerable code.
   3. Review the interactive data flow trace in the Issue Details view.
   4. Review the remediation guidance and training links in the How to Fix view.
   5. Update the issue status as work progresses.
6. Use CodeSweep for local scanning
7. Simply save any file in the workspace — CodeSweep automatically scans it for vulnerabilities.
   
   2. View findings in the CodeSweep tab within the AppScan view.
   3. Click on a finding's location to navigate to the affected line.
   4. Select an auto-fix from the drop-down to apply a recommended code fix.
   5. Open the CodeSweep Rules view to manage which rules are active per language.

Changelog

2.1.0 (June, 2026)

• CodeSweep — Local Static Analysis on Save: Automatically scan the active file for security vulnerabilities every time you save — no cloud connection required.
• Auto-Fix Suggestions: Receive actionable code fix suggestions directly in the findings table, then select and apply recommended fixes instantly.
• Noise Marking: Mark false-positive findings as noise to keep your results clean; these are persisted across sessions via Eclipse preferences.
• Language Rule Management: Browse, enable, or disable scanning rules by language category via the dedicated CodeSweep Rules View.
• Training Links in How to Fix Guidance: Access embedded training links directly within the "How to Fix" remediation guidance, contextually tailored to the specific vulnerability type (when enabled for your tenant).
• Interactive Data Flow in Issue Details: View the complete data flow path from source to sink as an interactive, expandable tree with click-to-navigate support and theme-aware rendering.
• Bug fixes and enhancements.

2.0.0 (March, 2026)

• Initial Release.
• Intelligent Fix Groups: Organize security findings into Fix Groups based on common fix locations, API calls, or vulnerability types to streamline remediation.
• Unified Scan Results: Access complete scan results from Static Application Security Testing (SAST) and Software Composition Analysis (SCA) in a single view.
• Real-Time Synchronization: Automatically synchronize security findings from AppScan on Cloud and AppScan 360° into your Eclipse workspace.
• Multi-Application Support: Switch between multiple applications using a searchable drop-down menu and intelligent filtering.
• Direct Source Navigation: Navigate from a security finding to the exact file and line number in the source code with a single click.
• Integrated Triage: Update issue statuses (Open, In Progress, Noise, Fixed, Passed), add comments, and apply sticky status options directly from the IDE.
• Severity-Based Prioritization: Focus on critical issues first using clear, color-coded severity indicators (Critical, High, Medium, Low, Informational).
• "How To Fix" Guidance View: Access embedded browser-based remediation guidance with language-specific examples and secure code snippets.
• Professional Reporting: Generate comprehensive security reports directly from Eclipse, including compliance-focused reports for PCI-DSS, HIPAA, and GDPR.
• Dedicated HCL AppScan Perspective: A pre-configured Eclipse perspective layout optimized for security analysis workflow.
• Flexible Authentication: Connect securely to HCL AppScan on Cloud and on-premise HCL AppScan 360° deployments using API keys.