After recovering from incidents, we must ensure that effective mitigation measures are in place to prevent similar issues in the future.
However, clearly expressing the characteristics of past problems and identifying similar occurrences across large codebases is a significant challenge, especially at the scale of ING.
We present our approach to encoding known and ING-specific (anti)patterns as CodeQL queries. These queries are used to assess both individual and multiple repositories, enabling us to pinpoint risks and reach out directly to the responsible teams, rather than broadcasting generic warnings to everyone.
A key challenge is the volume of findings: a single query can yield hundreds of results, overwhelming engineering teams if not managed carefully. To address this, we define a process that not only assesses findings but also generates actionable patches and contextual advice. By integrating Large Language Models (LLMs), we combine the specific context of each code finding with the surrounding source code and high-level problem descriptions, resulting in tailored, practical recommendations for engineers.
We translate incident learnings and ING-specific anti-patterns into CodeQL queries, making them reusable and scalable. For each finding, we use LLMs to generate context-aware advice and, where possible, code patches. This ensures recommendations are both actionable and relevant to the code owner.
By combining static analysis with LLM-driven advice, we turn past mistakes into valuable lessons, foster professional growth, and continuously improve our engineering community. We believe this approach is broadly applicable to other large organizations seeking to scale preventive mitigation.
Kevin van der Vlist is a software engineer at ING, focused on improving reliability and analyzing code across 75.000+ repositories. With an MSc from the University of Amsterdam and an Engineering Doctorate from the University of Twente, he specializes in software analysis to identify patterns and enhance code quality and security. The objective is to elevate code quality and security by offering developers guardrails, ensuring the reliability of INGs software systems.
