At a glance
- Problem
- Security findings become actionable only when developers can connect scanner evidence, source context, and the changes they need to verify.
- My contribution
- I built Marx to make Checkmarx validation at work more practical and share the workflow with developers facing similar friction. The Go/Wails workbench connects the official CLI to durable jobs and reviewable remediation.
- Outcome
- Public MIT-licensed source and a native developer preview for macOS Apple Silicon and Windows x64. The Go/Wails rewrite is merged; live tenant verification and signed distribution are not complete.
Engineering decisions
01decision
Make the scan boundary explicit
The native host runs the installed official CLI. Users confirm source folders, project mappings, and scan options before selected source is uploaded to Checkmarx One for remote analysis.
TradeoffA local interface is not local security analysis. Organizations still need approved Checkmarx access and must control what source they upload.
02decision
Preserve uncertainty instead of retrying blindly
Durable jobs retain known scans across restart. An interrupted or uncertain submission remains visible rather than being automatically resubmitted.
TradeoffRecovery may require investigation instead of a reassuring success state; avoiding duplicate submissions is more important than hiding uncertainty.
03decision
Keep remediation tied to its evidence
The workflow connects finding investigation to locally generated coding-assistant prompts, pinned original evidence, change records, and evidence-qualified verification. Local decisions do not change the scanner's finding state.
TradeoffMarx prepares a deliberate handoff; it does not call a model or modify the repository. A recorded decision is not proof that a vulnerability is fixed.
04decision
Add intelligence without replacing scanner severity
Opt-in CISA KEV, FIRST EPSS, and CVE.org context accompanies explicit CVE findings. Sources start disabled, refresh is explicit, and missing or stale observations remain visible.
TradeoffAdditional signals help investigation but do not establish exploitability in a particular application. Local evidence and exports can contain sensitive data.
Inspect the implementation and its limits
- Native rewrite, review discussion, and outstanding qualification.
- Dated acceptance record distinguishes native synthetic checks, public-CVE lookups, and live-tenant gaps.
- Source walkthrough with native captures; displayed findings are synthetic.
- Security boundaries and local evidence-handling responsibilities.
Source and release links checked .
Scope and limits
Source-only developer preview, not a production-qualified installer release. Live Checkmarx tenant behavior has not been verified locally and requires approved work access. Latest Windows interaction changes, full screen-reader coverage, and distribution signing/notarization remain unqualified. Synthetic acceptance does not establish tenant compatibility, security efficacy, adoption, or Checkmarx sponsorship.
The remediation loop
- 01
Configure the approved CLI and explicitly map a source folder to its Checkmarx project.
- 02
Review scan options, submit, and investigate findings with source context.
- 03
Prepare a local assistant handoff and preserve the original evidence.
- 04
Record changes, compare eligible verification evidence, and keep inconclusive results visible.