DEV Community: Dragonsoft DevSecOps

Let Crashes "Speak": How AI Identifies Root Cause Signals From "Noise"

Dragonsoft DevSecOps — Sat, 10 Oct 2026 01:56:45 +0000

As AI technology continues to evolve, game crash governance is shifting from passive response to proactive prevention. Tencent's CrashSight platform transforms game crash management by using intelligent clustering and a hybrid reasoning framework.

Originally published on the WeTest blog. Reach out to DragonSoft, an authorized WeTest partner, for expert support and a free trial. Author: Baojian Shen，Senior Product Manager, Tencent WeTest

At the inflection point where the game industry is transitioning to long-term operations, we are witnessing unprecedented challenges: the exponential growth of open-world map sizes, the soaring complexity of real-time physics simulations, and the increasingly stringent requirements for cross-platform synchronization. In the process of game development and operation, crash issues have always been a persistent headache. Take a game with 500,000 Daily Active Users (DAU) as an example—a mere 1% crash rate would affect 5,000 devices every day, resulting in over 10,000 crash incidents. Faced with massive volumes of crash stack data, development teams often fall into an "Blind men describing an elephant" dilemma in their analysis.

The Pain Points of Crash Management: Why Do We Need AI?

Traditional crash management approaches face two significant challenges:

1 Crash Clustering Issues

Traditional stack classification rules are highly dependent on manual work, with outdated technical methods and poor business outcomes. Static stack hash grouping and fixed rules struggle to cope with complex and variable risk behaviors, leading to persistently high rates of false positives and false negatives.

2 Difficulties in Root Cause Analysis

On average, it takes troubleshooting across more than 10 modules to locate the root cause. 70% of repair solutions rely on the empirical judgments of senior engineers. The lengthy process of problem troubleshooting and verification results in hidden business losses.

Technological Breakthroughs: Three Innovative AI-Driven Solutions

1 Intelligent Clustering and Deduplication: Extracting Valid Signals from "Noise."

Tencent's CrashSight platform leverages AI technology to achieve intelligent aggregation and deduplication of crash issues, effectively addressing the limitations of traditional classification rules. In practical applications, this technology has demonstrated remarkable results—the number of erroneous classifications has been reduced by up to 70.08% after optimization, significantly improving classification accuracy.

The core value of this intelligent clustering technology lies in its ability to automatically identify and filter stack information containing variables such as dynamic names and Universally Unique Identifiers (UUIDs), avoiding misclassification caused by fixed rules in traditional methods. Through machine learning algorithms, the system can understand the semantic meaning of stacks, rather than just performing superficial pattern matching.

2 Reducing Manual Dependency: AI-Powered Root Cause Diagnostics

By automating pipelines to aggregate fragmented information, CrashSight utilizes knowledge graphs and intelligent algorithms to simulate the debugging logic of senior engineers. It tightly integrates code repositories with runtime data, ultimately achieving a qualitative leap from "observing the symptom" to "locating the root cause and suggesting fixes." This represents a deep practice of both DevOps and AIOps philosophies.

We have designed two components for root cause analysis: online analysis and offline analysis. The online component is based on a multi-step reasoning framework powered by Retrieval-Augmented Generation (RAG), which can analyze crash stacks layer by layer, track error propagation paths, and ultimately pinpoint the root cause. The offline component supports local deployment of code snippet acquisition modules, enabling fast matching and retrieval of issue-related code for analysis without uploading full code, thus maximizing the security of business code and core assets.

3 Limiting AI Hallucinations: Application of Hybrid Reasoning Framework

Due to scattered and incomplete log information, a large number of duplicate logs obscure key details. When large models process long contexts, they consume substantial tokens, which is prone to inducing AI hallucinations and compromising analysis accuracy.

CrashSight adopts an innovative hybrid reasoning framework that combines Tree of Thought with the Long-text Abstractive Selection (LATS) method, building a truly intelligent multi-step reasoning engine. The workflow of this engine starts with the generation and exploration of multi-branch hypotheses—the system simultaneously considers multiple potential crash causes instead of confining itself to a single direction. After hypothesis generation, the engine initiates an evidence-driven dynamic evaluation mechanism, verifying the rationality of each hypothesis using real-time collected crash data, log information and other evidence.

Next comes the recursive in-depth analysis phase, where the system conducts layered analysis on hypotheses that pass the preliminary evaluation, tracing back from surface phenomena to the fundamental root cause. This process simulates the troubleshooting logic of senior engineers, with greatly improved speed and precision. Finally, the system generates structured output results, ensuring that each conclusion is supported by a complete evidence chain and features strong interpretability.

It can not only locate the exact files, functions and crash points, but also provide directly usable patch code. Additionally, it delivers a prioritized list of repair solutions categorized into emergency fixes, root cause repairs and long-term reinforcement, truly realizing an intelligent leap from "phenomenon" to "truth".

Transforming from "Firefighters" to "Prophets"

We systematically promote the integration of AI and tools through a three-phase model:

In the tool enhancement phase, we automate single-point tasks to achieve "point-level" applications;
In the process optimization phase, we embed AI into the complete business workflow to achieve "line-level" applications;
Ultimately, in the strategic empowerment phase, we transform AI from "supporting business" to "driving business", realizing "full-scale" applications.

This evolution has enabled AI to become a "prophet" and "sentinel" in the quality defense line. With its intelligent core engine providing prediction, diagnosis and attribution capabilities, it seamlessly integrates with existing development toolchains, greatly enhancing developers' work efficiency and job satisfaction.

Conclusion：

In today's era of rapid AI development, following the trend may lead to detours, but ignoring it will surely result in missed opportunities. Mistakes can be corrected, but lost opportunities are gone forever! Game developers and technical teams should maintain an open mindset and actively embrace the transformative opportunities brought by AI technology.

As AI technology continues to evolve, game crash governance is shifting from passive response to proactive prevention. Tencent's CrashSight platform will continue to deepen its AI capabilities, providing game developers with more intelligent and efficient crash governance solutions.

About the Author：Baojian Shen is a Senior Product Manager at Tencent WeTest with over 10 years of experience in software testing and game testing. He leads product planning and solution development for testing platforms and quality engineering initiatives, focusing on automated testing, compatibility testing, performance testing, game testing solutions, and scalable test platform development. Baojian’s work bridges practical testing challenges and product strategy, with emphasis on AI-driven testing, quality engineering, and implementable, evidence-based methodologies. He regularly shares industry insights grounded in real-world projects and measurable outcomes.

For more information, please contact Dragonsoft at +852-5167-9050 or email us at customer@hkdsdtech.com

ITSM Case Study: SmartSearch Strengthens Security and Simplifies Service Management with HaloITSM

Dragonsoft DevSecOps — Fri, 09 Oct 2026 09:12:05 +0000

This article is based on an official HaloITSM case study.

As an authorized HaloITSM partner in Hong Kong, DragonSoft shares this transformation story to provide actionable insights for your organization. Discover how HaloITSM leverages automation, permission governance, and a unified service desk to resolve common ITSM challenges, including asset tracking, redundant communication, and inefficient ticket routing.

Interested in trialing HaloITSM? Contact the DragonSoft team today.

As a rapidly growing RegTech company, SmartSearch needed a secure, scalable ITSM platform. Replacing Freshdesk with HaloITSM brought automation, structure, and control.

Improved InfoSec and access governance across the business
Unified platform for IT visibility and control
Automated onboarding replaced manual processes

Industry：Service Providers
Region：Europe
Previous Tool：Freshdesk

About SmartSearch

SmartSearch is a leading provider of digital compliance and anti-money laundering solutions. As a fast-growing organisation with a strong focus on operational integrity, the team needed a reliable ITSM platform that could scale, streamline support, and enforce security best practices across the business.

The Challenge

SmartSearch was previously using Freshdesk alongside tools like SharePoint. While simple and user-friendly, the system lacked the functionality and control needed for a secure, scalable operation.

There was no way to track asset history, making it difficult to troubleshoot recurring issues. Request forms were unstructured, especially for processes requiring InfoSec or infrastructure input, often resulting in repeated back-and-forth to gather critical information. New user setup was fully manual, and the knowledge base had grown bloated and hard to use.

From a support standpoint, the team experienced major outages with no direct phone support and slow resolution times, creating unnecessary operational and security risk.

“It was quite a simple system, and that worked until we started looking at things like asset management, stocking levels, and knowledge sharing across teams.”– Matthew Collins, Service Desk Manager

The Solution

SmartSearch selected HaloITSM for its depth of functionality, flexible configuration, and strong balance of cost and capability. The platform was deployed quickly and addressed core service management and security priorities from day one.

The team now benefits from:

Asset histories linked to devices, reducing guesswork and repeat incidents
Azure AD integration to automatically create users with correct permissions
Structured request forms, improving data quality for InfoSec and infrastructure
Role-based visibility and access control, ensuring teams only see what they need
Two-tier knowledge base, split for end users and technical staff
SLA tracking and alerts, helping teams prioritise before deadlines are missed
Reliable support, with a phone line, service status tracker, and known issues feed

“It brought everything into one place, we’ve reduced manual work, improved visibility, and the feedback from users has been really positive.”– Matthew Collins, Service Desk Manager

The Results

Since moving to HaloITSM, SmartSearch has seen measurable improvements in both efficiency and control. Manual tasks have been replaced by automation, and core processes, including onboarding and request approvals, are faster, clearer, and more secure.

Automated onboarding ensures correct access from day one
Role-based controls reduce over-permissioned access
InfoSec approval turnaround by structured tickets
SLA timers and alerts support proactive service delivery
Downtime risk reduced with reliable vendor support
Reduced back and forth between end-users and agents

“It’s been a huge step forward — and we’ve only just scratched the surface.”-Matthew Collins, Service Desk Manager

With change management, Azure DevOps integration, and an external knowledge base on the roadmap, the team is confident that HaloITSM will continue to support their growth, securely and at scale.

DragonSoft Support Services

As an authorized HaloITSM partner, DragonSoft holds official technical certification from HaloITSM. We provide end-to-end services for clients across China and Hong Kong, encompassing requirements analysis, solution customization, system implementation, professional training, and ongoing managed support.

If you are planning to replace your current service desk tool or want to evaluate how HaloITSM can elevate your service operations, contact the DragonSoft team today to schedule a product demo and a customized solution assessment.

Website: www.hkdsdtech.com
Phone: +852–51679050
Email: marketing@hkdsdtech.com

SonarQube Hunter Agent is now GA: Catch broken access control and business logic flaws

Dragonsoft DevSecOps — Fri, 09 Oct 2026 09:03:13 +0000

SonarQube has officially released Hunter Agent, a new AI security agent that elevates code security from traditional “syntax and data flow” analysis to the realm of “business logic and intent.”

As an authorized SonarQube partner in Hong Kong, DragonSoft remains at the forefront of code security practices.In this article, we break down this major update and explore how Hunter Agent completes the code security puzzle in the AI era.

Source: SonarQube Official Blog；Original Author: Satinder Khasriya, Product Marketing Manager, Code Security

TLDR overview

In 2026, a researcher was paid a $78,000 bug bounty for finding a flaw in Meta’s systems: a logged-in user could pull another user’s private support tickets and personal data just by changing an identifier in a request. Authentication worked exactly as designed. The system correctly confirmed who the user was — it just never checked whether that user was allowed to see that specific piece of data. SAST wouldn’t have caught it, because there was no data flow/injection issue in the code. It ran exactly as written.

This is one of many gaps SonarQube Hunter Agent is built to close, and as of today, it’s generally available on SonarQube Cloud. SonarQube Server support is coming soon.

Broken access control has been the OWASP Top 10’s #1 web application risk since 2021, and it isn’t shrinking: In OWASP’s 2025 testing, every single application tested (100%) had some form of broken access control. Researchers found over 1.8 million individual instances of it, spread across 40 different types of access control flaws more than any other risk category in the Top 10. It’s also the category security tooling is least equipped to find, and the problem is compounding: AI coding agents now author more than 42% of committed enterprise code, generating access-control logic, permission checks, and business workflows faster than any human review process was built to handle.

Vulnerabilities that SAST tools miss

SonarQube’s SAST engine is excellent at what it’s designed to do: algorithmic and data-flow analysis that trace tainted input from an untrusted source to a sensitive sink. That’s how it catches SQL injection, XSS, path traversal, hardcoded secrets, and hundreds of other vulnerability classes reliably, at scale, on every commit.

But there’s a category of vulnerability that sits outside what any SAST can reach, not because of a tooling limitation, but because of the nature of the question itself. Does /invoices/8472 check that the requesting user actually owns invoice 8472, or does it just return whatever record matches the ID? Is a role check enforced only in the UI, and never revalidated server-side? Does completing step 3 of a checkout flow actually require having completed step 2? None of these are syntax problems. They’re questions about intent, about what a system is supposed to do, versus what it actually lets you do. And answering them requires reasoning about identity, roles, and workflow logic that a static analyzer has no mechanism to evaluate.

For years, the only way to close that gap was people: senior engineers doing manual code review, external pentest engagements once or twice a year, bug bounty programs, pre-release audits. That model is running out of runway. AppSec talent is scarce, pentests are point-in-time snapshots with long gaps between them, and release velocity, accelerated by AI-generated code has outpaced what manual review can keep up with. The cost of leaving that gap open isn’t theoretical: broken access control alone exposed roughly 885 million records at First American, 64 million applicant records at McDonald’s, and drained $9 million from Yearn Finance in a single exploit. These are not edge cases but real headlines.

How does Hunter Agent detect logic flaws?

Hunter Agent is an AI security agent, native to SonarQube, that reasons through your codebase the way a human security researcher works through a whitebox audit and confirms every finding before it ever reaches a developer.

It targets three classes of logic-level vulnerability that pattern-based scanning structurally cannot evaluate:

Broken access control: IDOR, missing or incorrect authorization checks, privilege escalation, CSRF, sensitive data exposure
Business logic flaws: skipped workflow steps, abuse of repeatable actions, missing rate limits
Authentication & session management flaws: session fixation, non-expiring sessions, weak password recovery, missing MFA, brute-force gaps

Under the hood, Hunter Agent runs on the harness used by the SWE-bench-leading Sonar Foundation Agent. Rather than issuing a single prompt and taking whatever the model returns, it executes a structured, multi-phase pipeline:

Analyze: runs security playbooks in parallel across chunks of the codebase to surface candidate issues
Explore: maps the structure of the repository and splits it into manageable segments, which is how the agent scales to codebases beyond 10 million lines of code
Validate exploitability: a dedicated subagent takes each candidate finding and actively explores whether a feasible attack path exists, discarding anything it can’t substantiate
Synthesize: consolidates validated findings into a single, reported result

From the outside, using it collapses to four steps with effectively zero setup: connect a SonarQube project (nothing to install), the playbook runs the analysis, the validation subagent confirms exploitability, and confirmed findings are raised as SonarQube issues — tagged, triaged, and gated exactly like any other finding your team already reviews. There’s no separate portal and no new dashboard.

How reliable are SonarQube Hunter Agent’s findings?

Any sufficiently capable LLM can be prompted to “look for security bugs” in a codebase. The problem is that raw model output on a task like this is neither precise nor stable. Point a generic prompt at the same codebase twice and you can get three findings on one run and 60 on the next. That is a variance that makes the output impossible to build a process around. A security team can’t build a triage process around a tool that doesn’t agree with itself.

That’s the specific problem the exploitability-validation subagent is designed to solve: every candidate finding from the Analyze phase has to survive an independent attempt to demonstrate a feasible attack path before it’s allowed to surface. In practice, that pushes average precision to 80–90%, high enough that a finding from Hunter Agent can be treated as a real, actionable signal rather than something to filter through another layer of manual investigation. In internal testing, it has surfaced more than 200 zero-day vulnerabilities across popular, well-audited open source projects.

How do I automatically detect broken access control in source code?

Hunter Agent is designed to add a reasoning layer without adding friction. It can run as a background agent scheduled weekly or monthly against your main branch, or it can be triggered on demand. Findings surface asynchronously as SonarQube issues once they’re confirmed, alongside the SAST and SCA findings your team already triages.

That’s a deliberate design choice: surfacing both SAST issues and findings from Hunter Agent in the same workflow means you get full-spectrum coverage without forcing a tradeoff between depth and speed. It’s language-agnostic across the 40+ programming languages SonarQube already supports, and incremental scanning cuts re-scan time on large repositories by roughly half.

Layered, not just independent

The agent that reviews your code is not the agent or model that wrote it. As more of your codebase is authored by AI coding assistants or agents themselves, a structurally independent verification layer matters: it’s the difference between a system checking its own work and a second, differently purposed system checking whether the first one’s output actually enforces the rules it was supposed to.

That independence is layered. SAST catches static code flaws, SCA catches vulnerable dependencies, and Hunter Agent adds a third lens, reasoning over code the way a security researcher would and catching logic and behavioral issues the others aren’t built to see. Nothing is trusted by default to have caught everything alone, and that’s Sonar’s zero-trust, multilayered approach to verification.

Hunter Agent’s findings are also auditable: every finding carries the discovery path the agent followed, so a reviewer can see exactly how it got there.

Available today

SonarQube Hunter Agent is generally available now on SonarQube Cloud, for the Enterprise plan. Point it at any existing SonarQube project. There’s nothing new to install, no new config needed. Support for SonarQube Server is coming soon.

Logic-level vulnerabilities don’t announce themselves in a code review. They announce themselves in a breach report, or in someone else’s bug bounty payout. Hunter Agent exists to make sure it’s your team that finds them first.

As an authorized SonarQube partner in Hong Kong, DragonSoft boasts a seasoned implementation and services team. From product selection and license planning to deployment, customized solutions, training, technical support, and deep integration with AI coding tools, we provide localized, full-lifecycle professional support to help you build a robust code security defense.

Get ahead of the curve and experience the power of SonarQube Hunter Agent. Contact the Dragonsoft team today to schedule an exclusive product demo and a complimentary security assessment.
Website: www.hkdsdtech.com
Phone: +852–51679050
Email: marketing@hkdsdtech.com

What is Perforce Delphix?

Dragonsoft DevSecOps — Fri, 09 Oct 2026 08:56:48 +0000

Originally published on the Perforce blog. Reach out to DragonSoft, an authorized Perforce partner in HongKong, for expert support and a free trial. Original author: Aaron Jensen.

Today, enterprise leaders face a common dilemma: the need to innovate faster while contending with strict compliance regulations and soaring infrastructure costs. The real bottleneck, however, is not a lack of ideas or talent — it’s data. Teams often wait days or even weeks to get the data they need to build and test.

According to Perforce Delphix’s 2026 Test Data Management Report for AI-Ready Enterprises, 99% of organizations wait longer than one business day for a fresh full production copy of test data, with 42% waiting weeks or months. That delay is not an edge case; it is the industry norm.

As an authorized Perforce partner in China, DragonSoft has specially compiled this article to share how Perforce Delphix solves this challenge — helping you deliver fast, trusted, AI-ready data — anywhere — so your teams can focus on what matters most: innovation.

What is Delphix?

Perforce Delphix is the intelligent data automation platform that accelerates development speed, delivers software quality, and ensures data compliance and security. By unifying data delivery, governance, and compliance into a single secure platform, Delphix helps enterprises modernize across multicloud and hybrid environments.

Who is Delphix as a Company?

Delphix is part of Perforce Software.

Enterprises around the world choose Delphix to automate compliant data for DevOps.

Businesses must innovate quickly but struggle to balance speed with quality and compliance. The Delphix DevOps Data Platform provides integrated data masking and database virtualization to rapidly deploy compliant, production-like data into non-production environments across private, public, and hybrid clouds.

With Delphix, customers automate test data management and CI/CD, create pipelines, and swiftly recover from downtime events such as ransomware, while ensuring data privacy and governance.

Perforce is the DevOps company for global teams looking for speed, quality, security, and compliance at scale along the development lifecycle. Perforce acquired Delphix in early 2024.

What Does Delphix Do?

The Delphix DevOps Data Platform is an intelligent data automation platform that delivers fast, trusted, AI-ready data anywhere teams need it. It helps IT operations, application development, quality assurance (QA), and analytics teams automate the full non-production data lifecycle. It lets them access high-quality data on demand, accelerate releases, and reduce compliance and security risk.

What are the Key Use Cases for Delphix?

Database Virtualization

Delphix empowers your company to clone databases in minutes regardless of the size — without duplicating storage. This reduces data footprints by 10x and accelerates provisioning by 100x. The result? Faster development speed.

In fact, according to an IDC study* of Perforce Delphix customers across multiple verticals, teams that automate their test data management with Delphix are 58% faster to develop a new application.

Data Masking & Compliance

Delphix empowers your company to mask sensitive data from production databases and deploy it to lower environments quickly. This eliminates sensitive data risks and ensures compliance with regulations — without sacrificing speed or quality.

According to that same IDC study, with Delphix, 77.2% more data and data environments were masked and protected.

Test Data Management

Delphix provisions test data efficiently, allowing your company to test often and early with realistic, compliant test data. The result? Increase project velocity by 2x and improve software quality.

According to our Test Data Management Report for AI-Ready Enterprises, 43% of organizations rank consistent, high-quality test data as their top priority for test data automation, yet 39% report data quality or validity issues as their biggest challenge. Delphix closes that gap by provisioning realistic, compliant test data on demand.

AI & Analytics Compliance

We know that modern enterprises need more than just test data; they need data for intelligence. Delphix delivers compliant, high-quality data wherever you need it across analytics and AI initiatives. You can accelerate innovation securely with AI-powered synthetic and masked data for DevOps without slowing down your teams.

Perforce Delphix was recently cited as a Gartner Peer Insights™ Customers’ Choice in the 2025 Voice of the Customer for Test Data Management*.

How Does Delphix Compare to the Competition?

You might wonder how Delphix stacks up against other approaches, such as custom scripts, standalone masking tools, or MicroDB/Fabric-based tools. Unlike point solutions that only solve one part of the puzzle, Delphix provides a comprehensive, enterprise-ready platform.

Delphix combines data masking, virtualization, synthetic data, and delivery into one scalable solution. This allows you to automate compliant data to power DevOps and AI innovation, rather than piecing together disparate tools that create friction and risk.

What are Delphix’s Key Capabilities?

Delphix allows you to make fully read-writeable clones of your production database in lower environments in minutes using virtually no storage for each additional copy.

Delphix also has the industry’s most sophisticated data masking solution so you can easily discover and mask any sensitive data, replacing it with fictitious data. This allows you to have full lookalike copies of your production database in your lower environments in a fraction of the time it normally takes to copy production down to non-production — and at a fraction of the cost of normal database copies.

Connect Data
Delphix allows you to connect with your key data sources, such as:

Traditional databases like Oracle, Microsoft SQL, Postgres, DB2, etc.
No SQL databases like MongoDB, Cassandra, Cockroach, etc.
Analytical sources like Snowflake or Databricks.
Cloud sources like AWS, Microsoft Azure, and Google Cloud Platform.
And many more.

Virtualize Databases and Mask Data for Compliance
Delphix virtualizes full databases and masks sensitive data like personal identifiable information (PII) and protected health information (PHI) in compliance with longstanding data privacy regulations like GDPR and HIPAA, as well as new regulations like DORA and the EU AI Act.

Deploy Quality Data Fast
Masked data can then be quickly deployed to downstream development and testing teams. These teams are then able to use production-like data in non-production environments. The quality of data is assured because masking results in realistic data preserving referential integrity across tables and databases. And the teams using the data can do so without introducing security or compliance risks.

How Does Delphix Work?

Delphix works by automating the end-to-end delivery, protection, and reuse of enterprise data — so teams can provision compliant, production-like data in minutes, empower developers with self-service access, and embed data automation directly into DevOps pipelines.

1. Install Delphix Components

Delphix has two main components: database virtualization and data masking.

These components can be installed independently or together. You can either download the components as VM images or deploy them to your cloud provider as a machine image from the cloud provider’s marketplace.

Download the Medium App
The Delphix virtualization appliance is a virtual appliance that lives between your database management system (DBMS) instances and the storage layer.

2. Connect Your Databases

Getting production data into the Delphix virtualization appliance involves either:

A connection to the production database where Delphix ingests the data from using the database’s native backup process (by using RMAN or Microsoft SQL native backups, for example).

Via a third-party backup restore process where a backup is restored to a staging server attached to the Delphix appliance.

Once the backups are replayed into the Delphix appliance, Delphix creates a continual flow of changes from the production instance — using incremental or full backups in an automated fashion.

3. Save on Database Sizes Fast

Once a database is ingested into Delphix, it is typically compressed to a third of the original size. Once ingested, users can then mount virtual databases (VDBs) to target DBMS in your lower environment.

Delphix will orchestrate a network connection to the target DBMS and mount a set of data files representing the desired database at any desired point in the database’s timeline. This allows users to provision a new copy of a database in a few minutes regardless of the size of the database.

We have customers with databases that are over 1 PETABYTE that create a fully independent, read-/writeable copy in lower environments in under 5 minutes!

4. Empower Developers and Testers

In addition to significantly increased speed in provisioning the database, Delphix also provides a significant advantage in the way of self-service controls. Developers and testers can self-administer the virtual database to refresh it to the latest image, rewind it to a previous version, or bookmark and share a virtual database with another user.

5. Automate Compliant Data in DevOps Pipelines

Delphix is built API-first, and all the functions are available as simple commands. This allows teams to easily embed database functions into your DevOps build pipelines. Customers can provision databases into ephemeral environments in minutes as part of a pipeline job. They can re-baseline their database — picking up database changes that have been checked into a build and deploying them to the latest clone of the production database — simulating a production deployment as part of a unit test.

Delphix allows you to get to true CI/CD with all your databases — without the wait and waste typically involved in backing up and restoring full copies. There is no better way to embed data quality and database development functions into automation pipelines.

Who Uses Delphix?

The world’s largest enterprises rely on Delphix to innovate, accelerate, and comply. It is trusted by 3 of the top 5 financial institutions and 4 of the top 5 healthcare insurers.

Worldpay

Worldpay, a financial services organization, uses Delphix to accelerate test cycles, improve quality, and mask sensitive data. By choosing Delphix, they were able to deliver:

85% faster data delivery, reducing a 28-day process to just 4.
Higher software quality from timely, complete test environments.
Improved security and compliance across 12+ non-prod environments.

Delta Dental

Before Delta Dental, an insurance provider, began using Delphix, it would take eight weeks to extract data, and it was difficult to protect data for compliance. Now, they’re able to:

Accelerate database migration timelines by 20%.
Move data to cloud environments in just hours, not weeks.
Mask sensitive PII and PHI before replicating data to AWS.
Deliver virtual data copies to a team of 200 developers in minutes.

Mattel

Mattel, a consumer goods company, uses Delphix to virtualize and modernize. With Delphix, they’ve reduced:

Database refresh time from five days to 48 hours.
Database size by 8 TB.
Human hours by 600%.

Sky Italia

Sky Italia, a telecom company, uses Delphix to achieve regulatory compliance while improving security and test data management procedures.

By choosing Delphix, they:

Achieved GDPR compliance in five months.
Reduced infrastructure footprint by 90%.
Reduced operational costs by 30%.

Choice Hotels

Choice Hotels, in the hospitality industry, uses Delphix to accelerate application building and automated testing while masking data. As a result, they have had:

90% faster database refreshes.
Significant cost savings by minimizing database storage requirements.
Improved software quality through consistent, repeatable testing.

How to Get Started with Delphix?

Perforce Delphix empowers teams to accelerate DevOps. With Delphix, there are no trade-offs necessary. Your company can have it all: compliance, quality, and speed.

As an authorized Perforce partner in HongKong, DragonSoft has a localized technical team and extensive implementation experience. We provide you with Perforce Delphix products and solutions, along with full-process support from consulting and deployment to training and operations — helping you achieve rapid results in scenarios such as DevOps, test data management, data masking and compliance, and AI and analytics.

See for yourself how Delphix powers AI and DevOps innovation. Request a custom, no-pressure demo from our specialists. We will walk you through Delphix for your key use cases.

Website: www.hkdsdtech.com
Phone: +852–51679050
Email: marketing@hkdsdtech.com

DragonSoft Announces Strategic Partnership with aqua cloud to Introduce AI-Powered Test Management Solutions

Dragonsoft DevSecOps — Fri, 18 Sep 2026 08:15:44 +0000

As software delivery cycles accelerate in the AI era, traditional test management models are struggling to keep pace with the demands of Agile and DevSecOps transformations. To help enterprises overcome this bottleneck, DragonSoft, a leading DevSecOps solutions provider, today announced a strategic partnership with aqua cloud, a AI-powered test management platform.

Through this partnership, DragonSoft will introduce aqua cloud to the Greater China and Japan markets. This move significantly expands DragonSoft's DevSecOps toolchain portfolio, enabling the company to offer enterprises a comprehensive, end-to-end solution encompassing team collaboration, requirement management, version control, digital asset management, compliance, test management, and IT operation.

Two Decades of DevSecOps Expertise: Expanding the Boundaries of Test Management

Founded in 2006, DragonSoft has spent nearly two decades at the forefront of the DevSecOps landscape. We have built a robust ecosystem by integrating industry-leading products from global tech giants, including Atlassian (Jira, Confluence, Rovo), Perforce (P4 for version control, QAC for static code analysis), JetBrains (IDEs), JFrog (Artifactory), and TESSY (automated unit testing). This integrated stack empowers organizations to implement secure, high-quality, and highly efficient software engineering practices.

Introducing aqua cloud marks a pivotal milestone in DragonSoft's strategy to deepen its test management capabilities. Leveraging its extensive footprint in the Jira ecosystem—highlighted by winning the "2024 APAC Sales Partner of the Year" award for Xray, a Jira test management app—DragonSoft is now fortifying its portfolio with aqua cloud. This addition equips clients with next-generation, AI-powered, and highly automated test management alternatives.

AI-Powered Test Management: Delivering Tangible Value to Customers in Gaming, Automotive, Finance, and Beyond

Recognized by Gartner as a leading AI-enabled solution in the category outside of the North America, aqua cloud supports public cloud, private cloud, and on-premises deployment models. This flexibility ensures seamless alignment with the stringent data security and compliance mandates of diverse enterprise environments.

Through this partnership, DragonSoft will deliver the following core capabilities to clients in highly regulated and fast-paced industries such as gaming, automotive, semiconductor, and finance:

Intelligent Test Planning and Execution: Leveraging AI capabilities, teams can plan test strategies, allocate resources, and identify risks more efficiently, significantly shortening test cycles and accelerating delivery.
Unprecedented Quality Visibility: End-to-end traceability from requirements to test cases provides clear visibility into project quality status, enabling management to make more precise, data-driven decisions.
Streamlined Regulatory Compliance: For heavily regulated sectors like finance and automotive, aqua cloud provides robust audit trails and automated compliance reporting, enabling organizations to navigate complex regulatory landscapes with ease.
Deeper Toolchain Integration: aqua cloud will deeply integrate with DragonSoft’s existing product lines, such as Atlassian and Perforce, to create a more comprehensive and unified DevSecOps workflow for customers.

"We are thrilled to announce this strategic partnership with aqua cloud," said He Ming, President of DragonSoft. "As a leading platform in the AI test management space, aqua cloud strongly complements the DevSecOps solutions we have honed over nearly two decades. DragonSoft has always been committed to introducing world-class tools to the Asian market and building customized, integrated DevSecOps solutions. This partnership will further enrich our test management product portfolio, helping our customers deliver better, faster, and more secure software."

Stefan Gogoll, CEO and Founder of aqua cloud, stated, "DragonSoft has cultivated profound customer relationships and demonstrated exceptional service excellence across several rapidly expanding markets in Asia. Their deep-rooted expertise in the DevSecOps domain is truly impressive. We look forward to leveraging DragonSoft's extensive channel network to bring aqua cloud to a broader base of enterprise clients."

About DragonSoft:
Dragonsoft is a leading DevSecOps solution provider with over a decade of expertise. It delivers end-to-end software lifecycle solutions and professional services by integrating methodologies like DevSecOps, ITSM, and Agile with industry-leading toolchains. Backed by comprehensive professional services, including strategic consulting, implementation, specialized training, and custom development, Dragonsoft’s technical excellence and deep industry experience have successfully empowered over 1,000 enterprises across the automotive, finance, gaming, healthcare, internet, and semiconductor sectors, earning widespread recognition and trust for its consistent, high-quality service.
Headquartered in Shanghai, China, Dragonsoft has branches in Hong Kong, Japan, and Canada, enabling a worldwide service network.

About aqua cloud:
aqua cloud is an AI-powered test management platform recognized by Gartner as a leading AI-enabled solution in the category outside of the North America. It helps teams plan, execute, and report on software testing at scale, ensuring compliance layer for private and public sector clients, as well as regulated industries. aqua cloud offers public and private cloud delivery models, as well as on-premise delivery. The company forms part of andagon holding GmbH, headquartered in Cologne, Germany.

Experience Next-Generation, AI-Powered Test Management Today! To discover the powerful capabilities of aqua cloud or to explore tailored DevSecOps solutions for your organization, contact the DragonSoft team:
Website: www.hkdsdtech.com
Phone: +852-51679050
Email: marketing@hkdsdtech.com

A guide to slash commands in the GitHub Copilot app

Dragonsoft DevSecOps — Fri, 18 Sep 2026 08:13:01 +0000

Many people use GitHub Copilot as a chat tool—describing requests one by one and waiting for replies. But to truly integrate Copilot into your development workflow, slash commands are a set of capabilities you can't afford to overlook.

As an authorized GitHub partner, DragonSoft has found through serving enterprise clients that the real gap in efficiency isn't about whether you can use Copilot—it's about whether you can embed it into your workflow. That's why we've put together this guide to slash commands in the GitHub Copilot app, covering the scenarios and practical examples for /plan, /spar, /autopilot, /rubber-duck, /create-canvas, /orchestrate, and more—helping you upgrade Copilot from a "chat assistant" to a "collaborator that moves projects forward."

If you’ve used slash commands in the GitHub Copilot CLI, you already know how powerful a quick / can be. In the GitHub Copilot app, slash commands take that idea further, giving you shortcuts for managing sessions, navigating projects, and customizing your Copilot workflow.

What are slash commands?

Slash commands are text shortcuts you type directly into the GitHub Copilot app’s chat composer. Start by typing / and an autocomplete menu appears, showing the commands available in your current context. It’s a small character with a lot of potential, opening the door to shortcuts that help you work with Copilot in new ways.

If you’re coming from the CLI, here’s the key difference: CLI slash commands are designed around a terminal-first workflow. Things like adding directories, setting your working directory, and managing terminal access happen through commands. This makes sense, because the CLI lives inside your terminal where there’s no visual interface.

💡Tip: If you’ve used slash commands in the Copilot CLI, you’ll notice some familiar faces. Commands like /clear and /model work in both places. But the GitHub Copilot app-specific commands are tailored for the multi-session workflow that the desktop app provides.

The app, on the other hand, provides a visual interface for managing context. File access commands like /add-dir or /cwd aren’t needed since the app manages project context automatically. App slash commands are more about workflows. You can navigate between sessions, manage projects, and control how the agent works.

Why use slash commands?

Slash commands may look like simple shortcuts, but they can change how you interact with Copilot. They help you move faster, stay focused, and quickly access the workflows you need. Instead of digging through options or breaking your focus to find the right tool, you can type a command and keep moving. A single / opens up the list of slash commands that can help you move faster, explore new ideas, and get the most out of the app.

Let’s take a look at some of the slash commands available in the GitHub Copilot app and how they can fit into your everyday workflows.

Before you write code, make a /plan

Good code starts with a good plan. /plan helps you break down a task before you start writing code, think through your approach, identify potential challenges, and decide what needs to happen next. It also switches your session into Plan mode, which you can also select from the Mode dropdown in the chat composer.

• Plan a new feature. Break down new feature ideas before jumping into implementation. Have Copilot identify files, components, and dependencies so you have a clearer path forward.

• /plan I need to add two-factor authentication to our application. Help me break down the work involved, identify what files need to change, and outline an implementation approach.

• Prepare for a large refactor. Map out complex changes before touching your code. Uncover potential risks and develop an incremental approach for making large changes safely.

• /plan We want to refactor our notification system code to make it easier to support new channels like push notifications. Help me understand the changes needed and create an incremental migration plan.

• Triage and fix bugs. If you know something is wrong but aren’t sure where to start, /plan can help you explore possible causes and outline the steps needed to diagnose and resolve the problem.

• /plan Users are reporting that our checkout flow randomly fails after payment processing. Help me investigate possible causes and create a plan to diagnose and fix the issue.

Let Copilot play devil’s advocate with /spar

Sometimes the best way to validate an idea is to challenge it. /spar is like that one teammate who raises their hand and asks, “Have we thought about what happens when this goes wrong?” It helps you pressure-test your approach by having Copilot question your assumptions and point out potential risks or tradeoffs before you commit to a solution. Here are a few ways you can use it:

• Validate an architecture choice. Pitch your plan to use Redis for caching and have Copilot question your invalidation strategy, scalability, or whether another approach better fits your workload.

• /spar I'm planning to use Redis as a caching layer for our product API. Challenge my approach and point out any scalability or consistency concerns I may have missed.

• Compare implementation options. Ask Copilot to debate the pros and cons of REST versus GraphQL, or synchronous versus asynchronous processing, based on your application’s requirements.

• /spar Help me decide between REST and GraphQL for a customer-facing API. Ask questions, challenge my assumptions, and recommend which approach fits best for an app with mobile clients.

• Review a migration plan. Walk through a database migration or infrastructure change and have Copilot identify edge cases, risks, or rollout concerns before you begin.

• /spar I'm migrating our database to a new managed service with minimal downtime. Poke holes in my migration plan and identify any risks or edge cases I should account for.

• Challenge a performance optimization. Share an optimization you’re considering and ask Copilot to point out hidden bottlenecks, unintended side effects, or simpler alternatives.

• /spar I'm planning to lazy load most of the components on my site to improve initial load time. Critique my approach and tell me where it could hurt user experience or introduce unnecessary complexity.

Let /autopilot take the wheel

Once you have a /plan, the next step is turning that idea into working code. /autopilot helps you work through implementation, make changes, and iterate as needed. Instead of managing each individual step, give Copilot a goal and let it work through the steps needed to complete the task. It also switches your session into Autopilot mode, which you can also select from the Mode dropdown in the chat composer.

• Implement a new feature. Hand off a task and let Copilot work through the implementation steps.

• /autopilot Add support for exporting user reports as CSV files. Identify the files that need changes, implement the feature, and update any relevant tests.

• Complete a larger maintenance task. Use /autopilot for tasks that require multiple steps, such as updating dependencies, refactoring code, or improving documentation.

• /autopilot Update this project to the latest version of React. Identify breaking changes, update the code where needed, and make sure the test suite passes.

Talk it through with /rubber-duck

/rubber-duck gives you something even better: a fresh set of eyes.

It uses a different model to independently review your work, helping surface blind spots, question assumptions, and catch issues your primary model may have missed. It’s especially useful for complex refactors, architectural decisions, migration plans, or any time you want a second opinion before moving forward.

• Get a second opinion on a plan. Before you start implementing a complex feature, have a different model independently review your plan and point out assumptions, missing steps, or potential risks.

• /rubber-duck Review the implementation plan we've created for adding two-factor authentication. Identify any blind spots, edge cases, or risks that we may have overlooked.

• Review a large refactor. After making significant changes, ask /rubber-duck to critique the approach and highlight anything that could be simplified, improved, or handled differently.

• /rubber-duck Review the refactoring we've completed for the notification system. Look for architectural concerns, unnecessary complexity, or areas that could be improved before I open a pull request.

• Validate a migration strategy. Before rolling out a complex migration, use a second model to independently evaluate your approach and identify rollout or reliability concerns.

• /rubber-duck Review our database migration plan and implementation. Point out any blind spots, rollback concerns, or edge cases we should address before deployment.

Turn conversations into interactive experiences with /create-canvas

Not every problem is best solved through a chat window. /create-canvas lets you create interactive interfaces directly from a conversation with Copilot. Instead of working through information in a long chat, you can turn it into a visualization, dashboard, or custom workflow you can interact with. For example:

• /create-canvas Create an interactive diagram showing how services in this application connect.

• /create-canvas Create an issue triage board that lets me review and categorize open issues.

When one task becomes many, use /orchestrate

Not every task fits neatly into a single workflow. Sometimes you need to make changes across multiple repositories or tackle several related tasks at once. /orchestrate helps you coordinate work across sessions and repositories by breaking larger efforts into smaller tasks that can move forward in parallel.

• Coordinate changes across repositories. When a feature touches multiple codebases, /orchestrate can help you track the work and coordinate updates across each repository.

• /orchestrate I need to add support for a new authentication flow across our frontend, backend, and shared repositories. Help me break down the work and coordinate the changes needed in each codebase.

• Manage parallel development tasks. For larger projects, Copilot can divide the work into focused efforts so multiple pieces can move forward together.

• /orchestrate Prepare this feature for release. Identify the work needed for implementation, testing, documentation, and deployment, then help coordinate each task.

Your next workflow starts with /

You don’t need to memorize any commands to get started. Pick a few slash commands that match how you work and build from there. The autocomplete menu has your back for the rest. Type / and start exploring!

DragonSoft Support

The value of slash commands isn't about memorizing every command—it's about finding the few that fit the way you work and making them part of your daily development process. Start with /plan to scope the work, use /spar to challenge your assumptions, let /autopilot drive implementation, and turn to /rubber-duck for a second opinion. These simple shortcuts represent a more efficient and more controllable way of working with Copilot.

As an authorized GitHub partner, DragonSoft doesn't just help you access GitHub Copilot—we support teams end to end, from solution consulting and deployment to hands-on training and best-practice development.

If you want your team to get up to speed with Copilot faster and put slash commands and multi-session workflows to real use, reach out to DragonSoft. We'll tailor our services and solutions to your development scenarios.

Website: www.hkdsdtech.com

Phone: +852-51679050

Email: marketing@hkdsdtech.com

Java Refactoring: Best Practices for Cleaner, More Maintainable Code

Dragonsoft DevSecOps — Fri, 18 Sep 2026 08:08:36 +0000

As Java codebases grow, teams change, and frameworks evolve, how do you keep your Java systems clean, maintainable, and easy to modify?

This post is adapted from the Perforce blog and compiled by DragonSoft, a Perforce authorized partner in HongKong. In this article, you'll learn what Java refactoring is, when to do it, and proven strategies to do it right. You'll also discover how Perforce JRebel and XRebel help development teams skip lengthy redeploys during refactoring, get instant feedback on code changes, and dramatically boost productivity.

What Is Java Refactoring?

Java refactoring is the process of improving the internal structure of code without changing its external or working behavior.

Refactoring is a practical way to keep applications maintainable as codebases grow, teams change, and frameworks evolve. It’s especially important when Java applications need to support new APIs, performance expectations, or modernization initiatives.

Why Java Refactoring Matters for Long-Term Code Quality
Refactoring helps:

• Reduce technical debt

• Improve readability

• Make code easier to test

• Lower the risk of future defects

By refactoring regularly, teams can improve readability, simplify complex logic, make code easier to test, and reduce the likelihood of future defects and vulnerabilities. Refactoring also helps Java applications stay ready for upgrades, framework changes, and new performance requirements.

Instead of waiting for technical debt to compound over time, making every future change slower and riskier, refactoring helps teams make continuous improvements that preserve business value while keeping the application maintainable over the long term.

When to Refactor Java Code

Think of refactoring as a best practice to maintain the codebase. It should always be followed as an ongoing, incremental practice rather than one bulk change. However, there are specific occasions such as upgrading or replacing frameworks and decommissioning old APIs or keywords where the need to refactor may become more pressing in order to maintain functionality.

Upgrading or Replacing Frameworks

Upgrading major framework versions, e.g. upgrading from Spring Boot 2.x to 3.x, often requires mandatory refactoring to introduce changes.

For example, when Oracle moved Java EE to Eclipse foundation, trademark rules forced a name change to Jakarta EE. javax.* namespace belongs to older Java EE versions (8 and below), while jakarta.* belongs to Jakarta EE 9 and newer.

Replacing a framework also requires refactoring, and the amount of refactoring depends on how deeply the old framework is tied to the business logic, the annotations used along with the data models.

Decommissioning Old APIs, Keywords, and Libraries

Refactoring is not a mandate if you are upgrading the JDK version of your application as Java supports backward compatibility. However, to avoid compilation errors, you must update the APIs if they are deprecated and eventually deleted from future versions of JDK.

Refactoring is also required if your code is using words that eventually become keywords in newer JDK versions: yield, var, record, etc.

If the code is dependent on third party libraries, those should be upgraded to understand the new JDK. Upgrading build tools such as Maven and Gradle is also required to understand the new JDK bytecode.

Refactoring vs. Rewriting

Refactoring and rewriting are often talked about together, but they solve different problems.

Refactoring improves the structure of existing Java code while preserving what the application already does. The goal is to make the code easier to understand, test, extend, and maintain without changing the user-facing behavior.

That makes refactoring a strong fit when an application still delivers business value but has become harder to update because of technical debt, outdated patterns, tight coupling, or duplicated logic.

Rewriting, on the other hand, means replacing larger parts of the system—or sometimes the entire application—with new code.

That can be necessary in specific cases, but it also introduces more delivery risk. Teams may need to recreate years of edge-case behavior, revalidate integrations, retrain developers, and run old and new systems in parallel while the replacement is built.

For most Java modernization projects, targeted refactoring is the safer and more practical path. Instead of pausing feature work for a risky rebuild, teams can improve the codebase incrementally and prepare older modules for newer Java versions or frameworks. This approach keeps the application working while making steady improvements that reduce complexity over time.

Java Refactoring Best Practices

Start with Testing

Just like you always want to wear a helmet when you're riding a bike, it is critical to provide test coverage before making any code change.

Never touch code that lacks test coverage—make use of Junit or Mockito to build a comprehensive test suite before refactoring the code. During each minor code change, make sure to test it against the test suite to immediately isolate the errors.

Always commit an existing working code before the refactoring begins and do small commits so the changes can be easily rolled back if the refactoring goes wrong.

Follow the Single Responsibility Pattern (SRP)

Follow Single Responsibility Pattern (SRP) to ensure every class/method does exactly one thing, as multiple jobs done by a single class create code complexities and maintenance problems.

Manage Classes

Scan for duplicate code and abstract them into shared utility classes that can be reused or use private helper methods.

Modern Java benefits from immutability, so it's beneficial for using final keywords for local variables or parameters or migrate data-carrier classes to Java Records.

Use Extract Method or Extract Class design patterns if the method/class is bloated and contains a huge number of lines of code. If the codebase contains deeply nested if-else blocks or large switch statements, use Guard Clauses that place conditional checks at the very beginning of the method to handle the invalid input, and write interfaces that provide polymorphism.

IDEs such as IntelliJ IDEA or Eclipse feature robust, safe refactoring engines, so you do not need to manually rename variables or move classes.

Keep Refactoring as a Separate Phase

Always wear one hat at a time; never fix a bug, add a new feature, and refactor at the same time. Keep them separate. If a feature requires refactoring, plan it in two distinct phases: refactor the code first, verify the test pass, commit, and then work on implementing a new feature.

Make the Code Reusable

When you are refactoring a codebase, always make the code reusable for future enhancements. Then, adding a new feature will be simple and straightforward, and you avoid the risk of making the code too rigid to accommodate the new enhancement.

For example, if a Constructor demands more than 5 arguments, then plan on using Builder Pattern or build a DTO to accommodate variables.

Speed Up Java Refactoring with Perforce JRebel and XRebel

XRebel speeds up Java refactoring by helping developers identify performance issues, database bottlenecks, and other problems earlier in development so they can fix issues quickly before they reach production.

Then, with JRebel, developers can view code changes quickly without repeated redeploys or losing application state. During refactoring, when developers make many small changes and need fast feedback, JRebel saves teams hours and helps them make improvements more efficiently.

DragonSoft Insights & Support

Refactoring isn't major surgery you only do when code is already "sick"—it's a continuous habit that should be woven into daily development. And the secret to making "small, frequent refactoring" truly work is minimizing the feedback loop after every code change. That's exactly where Perforce JRebel and XRebel shine.

As a Perforce authorized partner in HongKong, DragonSoft is committed to helping your team realize the full value of JRebel and XRebel. We provide:

Genuine Licensing – Official JRebel and XRebel license procurement, ensuring compliance and access to ongoing upgrades.
Turnkey Implementation – Full technical support from free trials, solution consulting, License configuration, and installation, to deep integration with your team's existing IDEs, frameworks, and CI pipelines.
Localized Services – Product documentation, Chinese / English technical support and training, with timely responses and zero communication barriers.

To start a free trial of JRebel / XRebel, or to learn about pricing and support options, contact DragonSoft:

Website: www.hkdsdtech.com

Phone: +852-51679050

Email: marketing@hkdsdtech.com

A review of the PerfDog evolution: Discussing mobile software QA with the founding developer of PerfDog

Dragonsoft DevSecOps — Thu, 03 Sep 2026 02:19:17 +0000

Originally published on the WeTest blog. Reach out to DragonSoft, an authorized WeTest partner, for expert support and a free trial.

Author: Baojian Shen,Senior Product Manager, Tencent WeTest

Awen Cao, Chairman of the MTSC (Make Tester Super Cool) Forum and Senior Testing Technology Director at Tencent, is the founding developer of the performance tool PerfDog. Since 2010, Awen has led the PerfDog team to focus on the game engine domain, providing performance optimization services specifically for Tencent Games. With the rapid development of PC and mobile games, the PerfDog team introduced Bench3D for PC game performance and PerfDog for mobile platforms. PerfDog became available to external users in 2019 and has since provided software performance testing services to hundreds of thousands of businesses worldwide.

The Origin of PerfDog: The Challenge of Platform Fragmentation

PerfDog’s development started due to the explosive popularity of PUBG: Battlegrounds. In 2018, PUBG took the world by storm, significantly boosting global PC hardware sales by 40% that year. The game development team aimed to port this game to mobile platforms, maintaining the same gameplay and PC-like experience, leading to the development of PUBG Mobile. This was the first time the PUBG team attempted to create a next-gen quality game using the UE engine on a mobile platform, presenting a significant challenge.

During the performance testing phase, the team faced cross-platform testing issues between iOS and Android. For iOS, applicable Xcode tools only worked in Mac or debug environments. Given the million-plus lines of code in a UE engine game, compiling in debug mode without errors took at least a day, making the process inefficient. Furthermore, there was a lack of comparative data on competitors’ performance and industry standards.

On Android, its openness led manufacturers to release customized system versions with thousands of testing tools, but no unified tool for consistent analysis. Compatibility and accuracy issues further compounded testing challenges, resulting in frequent retests and misjudgments.

Faced with these challenges, Awen decided to lead the team in creating a solution. Their goal was to develop a simple, highly usable tool capable of supporting all mobile platforms. This marked the inception of PerfDog, which showed promising results in internal Tencent projects. As it was adopted for more projects, feedback from developers, testers, product managers, and designers helped refine PerfDog, leading to its public release in 2019.

Growth of PerfDog: Building a Robust User Ecosystem

From a game operator’s perspective, development teams strive to deliver better game experiences to players. With PUBG Mobile being seen as a potential phenomenon, OEMs paid close attention to its performance on their devices, sending their flagship phones to the game team for performance testing. This collaboration highlighted external demand for performance testing, prompting the PerfDog team to extend their tools to OEMs, enhancing player experiences across devices.

As mobile gaming grew, Awen and his team noticed players and tech YouTubers using PerfDog for performance evaluations. Users preferred PerfDog over traditional benchmarking, which only indicated hardware performance but not necessarily gaming experience quality. PerfDog effectively identified hardware performance issues and bugs, crucial factors affecting gameplay.

Social media and YouTube influenced players’ perceptions of device performance, impacting purchasing decisions, which in turn encouraged OEMs to optimize their hardware to address weaknesses identified by PerfDog. Sometimes, issues stem from inadequate GPU or chip optimization, prompting collaboration between OEMs and chip manufacturers for targeted improvements.

Through these partnerships, led by the shared goal of enhancing gaming performance, PerfDog fostered an ecosystem of continuous improvement, involving game companies, OEMs, and tech influencers.

PerfDog’s Evolution: Expanding Beyond Gaming

Initially designed for gaming, PerfDog’s applicability caught the attention of non-gaming teams, demonstrating its versatility. By opening up to external manufacturers, PerfDog found applications across smartphones, chips, and IoT devices, evolving into a universal testing tool suitable for diverse scenarios.

To ensure reliability and professional performance metrics, Awen’s team continuously validates PerfDog’s accuracy. Collaborations with the National Institute of Metrology helped PerfDog achieve authoritative certification. Legal compliance aided by Tencent’s international legal team further solidified PerfDog’s standing.

Awen recalls, “Initially, PerfDog was to serve the internal PUBG project. Later, it expanded within Tencent, then to domestic manufacturers. Eventually, international partners, including Supercell, Riot, EA, and companies like Samsung and SK, expressed interest, leading to PerfDog’s global launch in late 2019. By 2020, its presence at GDC garnered even more attention.”

PerfDog has evolved from a test tool to integrating cloud services and the PerfDog Service for industrial performance management. It also developed products like PerfSight and CrashSight for user game performance solutions and crash analysis, offering comprehensive and convenient gaming performance monitoring. PerfDog now supports a wide range of devices, from mobile phones to VR, providing end-to-end performance testing for apps, videos, browsers, and networks.

Understanding PerfDog’s Metrics
PerfDog features several intuitive metrics developed from team experience, including unique indicators like Jank, Smooth, and Frame Power (FPower).

Jank At WWDC 18, Apple introduced Frame Pacing, highlighting that a high frame rate doesn’t always equate to a smooth experience. Comparing left (40 FPS) and right (30 FPS) frames, the left shows obvious stutter due to a frame exceeding 100ms, while the right maintains a consistent 33ms/frame.

Though early Android had a reputation for lag, Google’s Project Butter - Jank, part of Android 4.4, introduced quantifiable smoothness metrics. Google Jank Calculation Logic: Considering the visual perception and the interval of v-sync in hardware, if the display does not refresh for a subsequent v-sync, it is considered a jank, meaning the next v-sync did not trigger a new frame refresh.

Awen observed that FPS does not fully encompass the user experience, necessitating the integration of multiple metrics for comprehensive analysis. The initial methods combining FPS and Jank yielded discrepancies with user perception, which led to PerfDog's refined Jank metrics. Following the upgrade, the PerfDog team launched the enhanced PerfDogJank indicator and promoted it to the gaming industry. However, a new challenge soon emerged. By 2019, the majority of mobile devices had refresh rates of 60 fps, while flagship phones released after 2020 already had refresh rates of over 120 fps. The rapid upgrade of hardware has led to an increase in user expectations regarding game performance. Even the slightest lag may now be perceived by users, and the established PerfDogJank standard is no longer sufficient for performance testing. Consequently, in subsequent versions, a new indicator, SmallJank, has been designed to accurately reflect minor stutters during the game and restore the real user experience.

Smooth Index The Smooth Index offers a more precise evaluation of the fluidity of a game or app. As illustrated in the frame rate screenshot below, while the overall frame rate of the image remains relatively stable, there is a notable fluctuation in the time taken for a single frame, as reflected in the FrameTime. This demonstrates that in instances where the frame rate remains unaltered, stuttering persists. Furthermore, the duration and performance outcomes of each lag vary. Consequently, the user's perception differs, despite the number of stutters remaining consistent. The development team required more precise metrics to analyse this phenomenon. To this end, PerfDog has introduced the Smooth indicator.

Frame Power (FPower) During the course of their interactions with numerous PerfDog project teams, the developers conveyed their aspiration for the incorporation of additional scientific and quantitative indicators to assess power consumption performance. This is also the rationale behind the FPower metric (energy consumption per frame) in PerfDog.

Awen commented, From the user perspective, it is important that games and apps run on their device with high frame rates, high image quality, low heat generation and low power consumption. However, this approach to performance scheduling will inevitably result in a fragmented user experience. As the temperature of your phone rises and its energy consumption increases, the processor operates less frequently, which in turn results in lower frame rates and a stuttering, overheating user experience. The PerfDog team conducted further analysis of the time and energy consumption of each frame of the software, which led to the development of FPower.

The frame rate is dependent on waiting and operation, while power consumption is determined by operation and mobilisation. It is only through optimising computing that power consumption can be truly optimised.

In the early stages of development, the team may implement measures such as reducing the frame rate to optimise energy consumption. While these adjustments reduce power consumption, they can negatively impact the user experience. The objective is to achieve power reduction without a noticeable change in frame rate. FPower = Power/Frame Rate is a more accurate metric that has become a key performance indicator for power optimisation in PerfDog.

Q&A Session: We have gathered some questions from users and invited Awen to answer them.

Q: Are there any breakthroughs or plans for PerfDog to access deeper-level metrics?

Awen: Absolutely, we aim to provide users with more comprehensive and in-depth low-level metric information. We are actively collaborating with hardware manufacturers like Qualcomm and Imagination. In the near future, we hope PerfDog will be able to offer users detailed information at the hardware and even driver levels, facilitating better and faster performance issue identification.

Q: In game projects, how do various numerical parameters affect the client, and which performance metrics should a new game focus on optimizing?

Awen: Games are incredibly complex from an app perspective, second only to operating systems. During game testing, looking at just one or a few metrics won’t reveal the true performance standards. We often advise examining a comprehensive range of metrics. Furthermore, differences between game types mean performance metrics can vary widely, so it’s not advisable to arbitrarily set standards for projects. I suggest using industry benchmarks from similar competitors as a reference for optimization. PerfDog already offers this functionality, and I encourage users to explore it.

Q: Can PerfDog use a single account to test multiple devices simultaneously?

Awen: Testing multiple phones with a single account on one computer is already a feature of PerfDog. By launching PerfDog software multiple times on a PC, you can test up to three phones simultaneously. Users might wonder why it’s limited to three devices. Given the extensive performance metrics and UI displayed during testing, testing too many phones simultaneously could lead to incomplete results or system overloads. We recommend testing on a maximum of three devices.

Are you curious about how PerfDog can elevate your game testing experience? Or perhaps you'd like to dive deeper into our other cutting-edge testing strategies? Either way, we'd love to hear from you. Our expert team is here to connect and provide you with the guidance and support you need to ensure your game testing is both efficient and precise.

Furthermore, we cordially invite you to try out Tencent's UDT platform, a cloud-based solution that grants you remote access to devices and seamlessly integrates with your local test devices, thereby broadening your testing horizons. We firmly believe that UDT can bring unmatched convenience and efficiency to your game testing endeavors.

About WeTest

WeTest, with over a decade of experience in quality management, is an integrated quality cloud platform dedicated to establishing global quality standards and enhancing product quality. As a member of the IEEE, approved Global Game Quality Assurance Working Group, it is recognized for its commitment to quality assurance. WeTest has served over 10,000 enterprise clients across 140+ countries.

Focusing on advanced testing tools development, WeTest integrates AI technology to launch professional game testing tools such as PerfDog, CrashSight, and UDT (Next-Gen Multi-Terminal Unified Access Management Automated Testing Platform), aiding over a million developers worldwide in boosting efficiency. Additionally, WeTest offers comprehensive testing service solutions for mobile, PC, and console games, covering compatibility, security, functionality, localization testing and other various services, ensuring product quality for over one thousand game companies globally.

About the Author
Baojian Shen is a Senior Product Manager at Tencent WeTest with over 10 years of experience in software testing and game testing. He leads product planning and solution development for testing platforms and quality engineering initiatives, focusing on automated testing, compatibility testing, performance testing, game testing solutions, and scalable test platform development. Baojian’s work bridges practical testing challenges and product strategy, with emphasis on AI-driven testing, quality engineering, and implementable, evidence-based methodologies. He regularly shares industry insights grounded in real-world projects and measurable outcomes.

For more information, please contact Dragonsoft at +852-5167-9050 or email us at customer@hkdsdtech.com

How to use AI for performance reviews: a step-by-step guide in 2026

Dragonsoft DevSecOps — Thu, 03 Sep 2026 02:07:46 +0000

Originally published on the monday blog. For expert guidance and support, reach out to DragonSoft, an authorized monday.com partner.

Performance review season has a way of exposing just how much managers rely on memory. When you’re reviewing 10 or 15 people at once, you’re trying to reconstruct months of projects, goals, feedback, 1:1s, and everyday contributions — often from information scattered across different places. AI can reduce some of the preparation involved by organizing review inputs, summarizing documented feedback, and surfacing patterns for the manager to examine.

An employee review template can standardize the questions, criteria, and evidence managers use across reviews. Employee self-evaluations provide another source of context by giving employees space to document achievements, challenges, and development priorities in their own words.

AI can help managers pull together performance evidence, summarize feedback, identify patterns, and turn raw information into a structured first draft. What it shouldn’t do is decide whether someone performed well. Ratings, promotions, compensation decisions, and the review conversation itself still require human judgment.

That distinction matters. The International Labour Organization (ILO) has highlighted risks associated with using AI in HR functions such as performance management, including biased or incomplete data, poorly defined objectives, and limited transparency.

In this guide, we’ll look at how to use AI for performance reviews, what information produces better results, how to write useful AI performance review prompts, and how monday AI Workspace can connect the process to the work employees actually did.

Key takeaways

AI is best used for drafting and synthesis, not decision-making. Let it organize evidence and create a starting point while managers retain responsibility for the evaluation
Good reviews start with good evidence. Project outcomes, goals, feedback, and check-in notes give AI something concrete to work with
AI doesn’t automatically eliminate bias. Human oversight is still essential, and AI-generated language should be checked for consistency and fairness
Connected work data makes AI more useful. When projects, goals, and feedback already live together, managers spend less time reconstructing performance at review time
People still own the consequential parts. Ratings, promotions, compensation, development conversations, and final decisions remain human responsibilities

What is an AI performance review?

An AI performance review is an employee performance evaluation where artificial intelligence assists with parts of the review process.

In practice, that usually means helping a manager turn a large amount of information into something useful. AI might summarize 360-degree feedback, organize achievements around specific goals, identify recurring themes in check-in notes, improve vague feedback, or draft a first version of the written evaluation.

The important word is assists.

There’s a significant difference between using AI to summarize evidence and using an algorithm to evaluate an employee. The ILO describes the broader use of automated systems to organize, monitor, supervise, and evaluate work as algorithmic management and has highlighted the risks that come with delegating managerial decisions to technology.

For performance reviews, a more useful division of responsibility looks like this:

This approach also reflects NIST’s AI Risk Management Framework, which emphasizes clear human roles, accountability, transparency, and oversight when AI contributes to decisions.

Why use AI for performance reviews?

Writing is only one part of a performance review. A lot of the work happens before anyone writes a sentence.

Managers need to remember what happened, find supporting evidence, read feedback, compare results against goals, and work out which events are actually representative of an employee’s performance across

the review period.

AI can reduce that administrative load.

Instead of manually rereading a year’s worth of project updates, for example, a manager can use AI to summarize the employee’s major deliverables, missed or exceeded goals, recurring feedback themes, and documented development areas. The manager then verifies those findings and decides what matters.

That can also help counter one of the weaknesses of memory-based reviews: recency bias. A project completed last month is naturally easier to remember than something delivered nine months ago. Giving AI structured evidence covering the whole review period can help bring older work back into view.

It’s important not to overstate this benefit, though. AI doesn’t automatically make an evaluation objective. NIST notes that bias can enter AI systems through human assumptions, underlying data, and system design. AI can help managers examine more evidence, but people still need to judge that evidence fairly.

What information should you give AI for a performance review?

The biggest mistake you can make is starting with the prompt. Begin by gathering the evidence that will inform the review, including agreed goals, documented outcomes, project updates, feedback, and relevant performance data.

An AI system asked to “write a great performance review for Sarah” has almost nothing useful to work with. It can produce polished performance-review language, but polished language isn’t the same thing as an accurate evaluation.

A better input combines the employee’s goals and OKRs, project outcomes, manager observations, 1:1 notes, peer or 360-degree feedback, documented recognition, and relevant development goals from the previous review.

Specificity matters here. Reviews are more useful when employees are evaluated against goals that were clearly defined in advance. A consistent goal-setting process gives managers and employees a shared reference point for evaluating progress.

“Improved customer retention” gives AI very little context. “Goal: increase renewal rate from 82% to 86% by Q4. Final result: 87.3%” gives it an outcome it can accurately reference.

Project information should work the same way. Rather than simply recording that someone “led the website project,” capture what they owned, who they worked with, the intended deadline, what happened, and what impact the project had.

The ILO has identified data quality as one of the central limitations organizations need to consider when using AI in HR. In performance reviews, that principle is fairly simple: vague evidence produces vague reviews.

How to use AI for performance reviews in seven steps

1. Gather evidence from the entire review period

Before opening an AI tool, gather the information you would need to defend the review yourself.

Look across goals and OKRs, completed projects, check-in notes, peer feedback, previous development goals, recognition, and any relevant performance documentation. Whenever possible, include dates, outcomes, and measurable results.

The aim isn’t to feed AI everything anyone has ever said about an employee. It’s to create a representative record of their performance across the full period.

2. Decide what AI is allowed to do

Set the boundary before you start.

You might decide AI can summarize feedback, organize achievements, draft sections of the review, suggest coaching questions, and help make language more specific. Final ratings, compensation, promotions, disciplinary decisions, and performance improvement plans stay with people.

This isn’t just good workflow design. The NIST AI Risk Management Framework emphasizes managing AI risks throughout the design, development, deployment, and use of AI systems.

3. Write an evidence-rich prompt

A useful AI performance review prompt explains the task, supplies the evidence, and tells the system what it must not infer.

For example:

Draft the achievements section of an annual performance review for a senior project manager. Use only the evidence provided below. Organize the review around business outcomes, collaboration, and delivery. Include specific examples where available. Do not invent achievements, motivations, or results. Flag anything that cannot be supported by the evidence.

Then provide the relevant information.

This gives AI a much narrower job than “write a performance review,” which makes the output easier to verify.

4. Treat the output as a first draft

AI-generated text can sound authoritative even when it is wrong, so the first draft needs active review.

Check whether every project, result, and claim is accurate. Look for achievements AI has exaggerated, team outcomes attributed to one person, missing context, or conclusions the evidence doesn’t support.

If the draft repeatedly gets something wrong, go back to the source information or prompt rather than simply polishing the sentence.

5. Make every important claim specific

One of AI’s most useful roles is helping managers move away from vague performance language.

“Alex demonstrated strong leadership this year” tells the employee very little.

“Alex led the Q3 website migration across design, engineering, and content, coordinating six contributors and delivering the project two weeks ahead of the revised deadline” explains what the manager actually means by leadership.

Not every sentence needs a metric, but consequential feedback should be grounded in something observable.

6. Check for bias and inconsistent language

AI can help identify inconsistent language, but it cannot certify that a review is unbiased.

Compare reviews across employees. Are similar accomplishments described with similar strength? Is one person described using personality labels while another is evaluated on outcomes? Does one employee receive detailed evidence while another gets vague judgments? Is a recent mistake overshadowing the rest of the year?

The ILO has specifically warned against assuming AI automatically makes HR decisions fairer. Biased inputs, poorly chosen objectives, and opaque systems can all affect the result.

That makes the human review stage essential.

7. Finalize the review and document the process

The manager should ultimately be able to stand behind every sentence in the final review.

Verify the evidence, add context AI couldn’t know, remove unsupported conclusions, make the final performance assessment yourself, and prepare for the employee’s questions.

Your organization should also retain appropriate documentation of the review process in line with its HR, privacy, and AI governance policies. NIST’s AI RMF treats governance and documentation as ongoing parts of responsible AI use rather than a final compliance check.

AI performance review prompt examples

A few reusable prompts make this section much more useful for people arriving from search.

To draft a review:

Using only the evidence provided below, draft an employee performance review covering achievements, areas for development, and progress against goals. Include specific examples where evidence is available. Do not invent results, motivations, or behaviors. Flag anything that isn’t sufficiently supported.

To summarize 360-degree feedback:

Summarize the feedback below into recurring themes. Separate strengths, development opportunities, and contradictory feedback. Indicate how many responses support each theme, and don’t treat a single comment as a pattern.

To improve vague manager feedback:

Rewrite the feedback below so it focuses on specific, observable behavior and outcomes. Preserve the manager’s intended meaning and don’t introduce facts or examples that aren’t provided.

To check reviews for consistency:

Compare these reviews for differences in tone, specificity, evidence, and performance standards. Flag places where similar performance appears to be described differently. Do not change ratings or make performance decisions.

Common mistakes when using AI for performance reviews

Asking AI to write a review without evidence

This is how you end up with an extremely professional paragraph saying essentially nothing.

AI needs something concrete to summarize. Without documented work, goals, and feedback, it is mostly generating plausible performance-review language.

Assuming AI-generated feedback is objective

AI output isn't inherently neutral.

The model, prompt, underlying information, and decisions made by the people using it can all influence the result. NIST’s framework specifically treats fairness, transparency, privacy, validity, and accountability as risks that need to be actively managed.

Putting sensitive employee information into an unapproved AI tool

Performance information can include confidential employee data. Before entering it into any AI system, check what your organization’s policies allow and how the provider handles access, retention, security, and model training.

Letting AI make the final performance decision

There’s a meaningful difference between asking AI to summarize evidence and asking it to decide whether someone deserves a promotion.

AI can make the first task easier. The second requires organizational accountability, context, and human judgment.

How monday AI Workspace supports AI-assisted performance reviews

The challenge with a standalone AI tool is that it doesn’t automatically know what happened at work.

Managers still need to find project information, collect feedback, copy in goals, explain context, and work out where every claim came from. That limits how much time AI can actually save.

monday AI Workspace brings the AI closer to the work itself. Projects, goals, workflows, feedback, and AI capabilities can operate in the same environment, making it easier to build reviews around documented performance rather than memory.

For example, monday Workforms can collect self-evaluations, manager observations, and peer feedback in a consistent format. Automations can handle review reminders and handoffs instead of HR manually chasing every participant.

AI blocks can help summarize written feedback and categorize recurring themes, while managers retain access to the original information for verification. Goals and OKRs can connect review discussions to the objectives employees were actually working toward.

For HR teams managing a review cycle across multiple departments, dashboards also provide a live view of which reviews are started, awaiting input, overdue, or complete. AI performance reviews work best as part of an ongoing performance management process rather than as a replacement for regular conversations between managers and employees.

The result isn’t an automated performance decision. It’s a more connected review process where the evidence, workflow, and AI assistance aren’t scattered across separate systems.

Building a better performance review process with AI

The strongest case for AI in performance reviews isn’t that a machine can write nicer feedback.

It’s that managers have more information to process than they can reliably hold in their heads.

Used well, AI can turn a year of goals, projects, notes, and feedback into a more manageable body of evidence. It can summarize information, structure a draft, highlight patterns, and help managers interrogate vague language.

But the final evaluation still belongs to people.

That’s especially important as AI becomes more deeply embedded in HR and performance management. Both the ILO’s research into AI in the workplace and NIST’s AI governance guidance emphasize the risks of treating automated outputs as inherently objective or removing meaningful human oversight.

With monday AI Workspace, teams can connect AI assistance directly to the projects, goals, feedback, and workflows where performance happens — helping managers spend less time reconstructing the year and more time having a useful conversation about it.

For more information about monday AI Workspace , please contact DragonSoft, an authorized monday.com partner.

Website: www.hkdsdtech.com

Phone: +852-51679050

Email: marketing@hkdsdtech.com

Sonar Launches Sonar Vortex and SonarQube Remediation Agent to Improve Agentic Effectiveness

Dragonsoft DevSecOps — Thu, 03 Sep 2026 02:01:19 +0000

AI agents now generate over 40% of committed enterprise code, yet the gap between rapid code generation and robust verification continues to widen. How can organizations harness the power of AI development while effectively governing code compliance and controlling token costs?

Sonar has launched Sonar Vortex and the SonarQube Remediation Agent to directly tackle three critical pain points: agentic code quality, token consumption, and technical debt, making enterprise AI investments more efficient and sustainable.

In this article, DragonSoft, an authorized SonarQube partner in Hong Kong, breaks down the core value of these new offerings and provides actionable implementation support to help you build a trusted and highly efficient AI coding loop.

New offerings improve quality of agentic output, decrease token usage by up to 36%, and autonomously burn down technical debt

AI agents now assist in generating more than 40% of committed enterprise code and the gap between how fast that code gets written and how well it gets verified is growing. Most organizations know they need to govern agentic output. Far fewer have a clear, practical path to doing so. Today, Sonar, a global leader in AI code verification, governance, and efficiency is changing that with the launches of Sonar Vortex and the SonarQube Remediation Agent.

Available today, the new products improve agentic development in three ways:

• Ensure agents write conformant code from the start by injecting your project's standards before generation, and then verifies the agent-written code against your team's quality and security standards while it's being written

• Cut LLM token consumption by up to 36% by delivering precise, governed context in a single call, eliminating the iterative file discovery that drives up cost

• Autonomously burn down technical debt at scale, working asynchronously in the background to generate, verify, and raise ready-to-merge PRs without pulling developers away from new work

“The industry conversation about AI slop, token efficiency, and compounding technical risk has been building for months, if not longer,” said Tariq Shaukat, CEO of Sonar. “What's been missing is a way to address those three issues where they occur: inside the agentic loop. We're delivering AI and development leaders a solution they can trust to make their investments in AI more efficient, effective, and sustainable.”

Compounding agentic productivity

Agents are limited by what they don't know. They fall down when they lack the context of architecture, security and quality standards, approved libraries, an organization's conventions, and so on. Left ungoverned, they produce code that works in isolation but often violates the rules of the system it's entering. And the fixes cost more with every passing sprint. Sonar's new offerings address these challenges on both sides of the agentic development loop: Sonar Vortex improves the effectiveness of agents building new code, while the SonarQube Remediation Agent stops the accumulation of technical debt in the existing codebase.

Sonar Vortex: Improved agentic efficiency

Sonar Vortex is an agent effectiveness solution, built to guide, verify, and improve the quality of code agents produce. It works across models and toolchains, operating on two dimensions: agent development quality and token effectiveness.

Development quality

For development quality, Sonar Vortex guides agents with the context and constraints they need before they write a single line of code. This includes the same organizational standards, quality profiles, and security rules that govern projects throughout CI/CD. It then verifies agent output in real time, inside the inner loop, catching security, reliability, and maintainability issues before any PR exists. This approach ensures code conforms from the first line, not after a review cycle. The result is consistent, explainable findings that hold up across teams, tools, and branches.

Token effectiveness

New Sonar research quantifies the impact of Sonar Vortex on token efficiency. In controlled benchmarks across Java, Python, TypeScript, and C#, run on Claude Opus 4.8, a leading frontier model, Sonar Vortex reduced LLM token consumption by up to 36% on refactoring tasks where code discovery represents the majority of the work. Rather than requiring agents to search iteratively and carry context forward across many files, Sonar Vortex delivers governed context in a single, precise call, resulting in less exploration. As a result, in testing, Sonar saw significantly lower token costs and more predictable spend.

Agents that leverage Sonar Vortex produce better code the first time, with fewer tokens, fewer violations, and less rework. The new offering extends that same standard into the agentic loop, so the code AI writes is held to the same bar as everything else in your codebase, automatically, before it ever reaches CI. As AI development spend grows and scrutiny of what it produces grows with it, Sonar gives engineering and AI leaders the answer to both: better output, lower token costs, and a defensible paper trail. The investment in AI gets more efficient and the risk gets smaller. That's the case every CTO needs to be able to make right now.

SonarQube Remediation Agent: Technical debt management

The SonarQube Remediation Agent is designed specifically for backlog burndown and operates as a background agent. Teams can assign historical issues (vulnerabilities, architectural drift, maintainability debt) from the SonarQube dashboard. The agent then works asynchronously, generating fixes, verifying each one against Sonar's own analysis engine, and raising verified, ready-to-merge PRs.

This approach greatly reduces developer toil or context-switching. Instead, every fix is proven clean before it surfaces. This is a proactive technical debt removal engine that targets the existing codebase at scale, without pulling developers away from shipping new work. Sonar was recently named a Leader in the Gartner® Magic Quadrant™ for Technical Debt Management¹.

Momentum behind the launch

Today's announcement is backed by the strongest financial position in Sonar's history. The company has surpassed $430 million in annual recurring revenue (ARR) with accelerated growth. More than 7 million developers use Sonar—75% of the Fortune 100 rely on it, including 19 of the top 20 banks globally outside China, as well as leading organizations like Nvidia, AstraZeneca, and Mercedes-Benz.

That scale reflects a market that considers verification mandatory. Organizations trust Sonar to analyze more than 750 billion lines of code daily. Teams using Sonar are 44% less likely to experience outages from AI-generated code.

About Sonar

Sonar, a global leader in AI code verification, governance, and efficiency, helps reduce outages, improve security, and lower costs and risks associated with AI and agentic coding. As an independent verification platform, Sonar enables organizations to securely develop at the speed of AI, and with the addition of Gitar's AI-native code review, offers the most comprehensive way to verify code in the agentic era. A Leader in the Gartner® Magic Quadrant™ for Technical Debt Management, Sonar is the foundation for high-performance software engineering—analyzing over 750 billion lines of code daily to ensure applications are secure, reliable, and maintainable. Rooted in the open source community, Sonar is trusted by 7M+ developers globally, including teams at Nvidia, ServiceNow, Booking.com, Goldman Sachs, AstraZeneca, and Ford Motor Company.

DragonSoft Support

As an authorized SonarQube partner, DragonSoft does more than just deliver the latest global product updates. We bring a seasoned team of implementation and service experts to ensure your success. From product selection and license planning, on-premise deployment, and custom quality and security policies, to deep integration with your CI/CD pipelines and AI coding toolchains, we provide localized, full-lifecycle professional support. We empower your team to move fast and stay secure in the AI era.

Act now to master code quality and costs in the AI era.

To learn more about the capabilities of Sonar Vortex and the SonarQube Remediation Agent, schedule a 1-on-1 product demo, or request a trial and customized quote, contact us today:

🌐 Website: www.hkdsdtech.com

📞 Phone: +852-51679050

✉️ Email: marketing@hkdsdtech.com

The Pros and Cons of Wildfly for Java Developers and a Guide to Boosting Productivity with Perforce JRebel

Dragonsoft DevSecOps — Thu, 27 Aug 2026 01:55:59 +0000

Java developers constantly seek the right tools to build, test, and deploy applications quickly. Selecting the proper application server plays a major role in how well a team meets its goals.

WildFly stands out as a popular choice for teams that want a fast, lightweight, modular application server.

Read on to learn more about the core features of WildFly, how it compares to JBoss and GlassFish, and how you can speed up your workflow by using WildFly with JRebel.

For expert guidance and support, reach out to DragonSoft, an authorized Perforce partner.

What Is WildFly?

WildFly is a fully featured Java application server that provides the necessary environment to run Java web applications. Red Hat maintains the project, focusing on aggressive memory control and fast startup times. Because it uses JBoss Modules, it provides true application isolation and links only the specific JAR files your application needs.

Who Uses WildFly?

According to the 2025 Java Developer Productivity Report, 14% of respondents said they are using JBoss or WildFly as their application server. While 86% reported using Tomcat, WildFly was in equal company with application servers like Jetty (16%), WebLogic (9%), and WebSphere (8%). Interestingly, 14% of respondents reported they don't use an application server.

Common Use Cases for WildFly

Developers choose WildFly for a variety of reasons. It handles everything from traditional web applications to modern, distributed architectures. Additionally, WildFly has full Jakarta EE support, making it an excellent choice for enterprise Java applications.

Key use cases include:

• Running robust Java applications

• Building microservices that need a small memory footprint

• Scaling applications quickly due to its instant start times and stateless administration console

• Building Jakarta EE enterprise applications

Available Versions of WildFly

The community actively updates WildFly to support the latest Java standards. For instance, the WildFly 40 Beta 1 release offers deep integration with Jakarta EE 11 and Eclipse MicroProfile, giving developers the tools they need to stay current.

Is WildFly Open Source?

Yes, WildFly is completely open source. It is free for both development and production deployments. While it operates as a free community project, it still receives backing from Red Hat. If your team needs robust commercial support for WildFly, consider OpenLogic.

Comparing WildFly vs. JBoss

It's easy to confuse WildFly and JBoss because they share a common history. In 2012, Red Hat rebranded the open source community version of JBoss AS to WildFly.

The name JBoss now typically refers to JBoss Enterprise Application Platform (EAP). While JBoss EAP builds upon the WildFly source code, the two are not identical. The main differentiators are price, speed of updates, and support.

Comparing WildFly vs. GlassFish

GlassFish is another fully featured, open source application server for Java EE. Sun Microsystems originally sponsored it before Oracle acquired the project. Today, the Eclipse Foundation maintains the GlassFish code base.

For most modern development teams, WildFly wins out due to its speed, efficiency, and active community.

Develop Java Applications Faster With JRebel + WildFly

No matter which application server you choose, waiting for applications to redeploy breaks developer flow. Even with fast startup times for WildFly, those disruptions can hamper Java development productivity.

Fortunately, you can eliminate these frustrating delays by pairing WildFly with JRebel to eliminate redeploys, allowing you to see code changes in your application server instantly.

Final Thoughts

Choosing WildFly gives you a fast, modular, and standard-compliant foundation for your Java applications. When you compare it to alternatives like JBoss EAP and GlassFish, WildFly strikes a perfect balance between cutting-edge features and lightweight performance.

To maximize your efficiency, pair WildFly with tools like JRebel that compound that performance. Skip the rebuilds, keep your flow state intact, and deliver better software, faster.

DragonSoft Support

Whether you are evaluating WildFly as your application server or looking to introduce JRebel to break through development bottlenecks, DragonSoft, Perforce authorized partner, provides comprehensive, end-to-end solutions.

We offer official JRebel licensing, along with localized deployment, technical support, and tailored training, ensuring your team can maximize the full potential of the WildFly + JRebel solution.

🌐 Website: www.hkdsdtech.com

📞 Phone: +852-51679050

✉️ Email: marketing@hkdsdtech.com

4 Key GitHub Copilot Stats That Reveal the True Power of AI Coding!

Dragonsoft DevSecOps — Wed, 19 Aug 2026 06:13:19 +0000

As a globally acclaimed AI coding assistant, GitHub Copilot is fundamentally reshaping developer workflows. It goes far beyond smart code completion, deeply integrating into the entire lifecycle of code review, quality assurance, and security governance.

In this article, DragonSoft, GitHub’s authorized partner, will walk you through the core value and practical adoption strategies of GitHub Copilot, providing valuable insights to help your team evaluate and integrate AI coding assistants.

Accelerate timelines, improve the rigor of code reviews, and expand capacity for strategic initiatives.

Modern enterprises are under constant pressure to deliver software faster, with higher quality, and under increasingly complex governance expectations. As organizations scale, leaders often face a familiar challenge: developers are talented and motivated, but their time is consumed by repetitive tasks, fragmented workflows, and review bottlenecks. GitHub Copilot changes that equation.

GitHub Copilot enhances enterprise efficiency, elevates software quality, and provides strategic support to development teams. By embedding AI-powered assistance directly into workflows, GitHub Copilot accelerates digital transformation, reduces friction, and strengthens competitive advantage.

In this section, we'll review how GitHub Copilot:

• Enhances developers task resolution by 55%

• Increases developers reviews by 67%

• Improves code quality by 85%

• Help developers maintain flow by 88%

Free Developers' Time — 55% Faster Task Resolution
The journey begins where most development teams feel the strain: time. Developers spend a significant portion of their day on routine tasks including, boilerplate code, syntax lookups, and repetitive patterns. GitHub Copilot reduces this friction immediately.

Enterprises need developers focused on highvalue initiatives, not repetitive tasks. GitHub Copilot accelerates common programming work, freeing capacity for innovation.

Developers resolved programming tasks 55% faster with GitHub Copilot.

As developers gain back time, the next problem to solve is how this gained time translates into the collaborative processes that shape software quality. That leads us to the next dimension of GitHub Copilot’s impact: code reviews.

Enterprise-Ready AI — 67% Faster Reviews
Code reviews are essential for governance, security, and quality, and code reviews are also a common bottleneck. GitHub Copilot helps teams move through reviews with greater speed and clarity, reducing cycle times without compromising rigor.

GitHub Copilot is designed with enterprisegrade security, compliance, and governance in mind. Adoption by leaders like Duolingo demonstrates measurable gains in speed and review efficiency.

Duolingo reported a 25% increase in developer speed and 67% faster code reviews.

With time gained and review cycles accelerating, organizations naturally question if this speed comes at the cost of quality. The data shows the opposite. GitHub Copilot enhances confidence and elevates the standard of code being shipped.

GitHub Copilot Chat Improves Code Quality — 85% Confidence
GitHub Copilot Chat acts as a realtime collaborator, helping developers reason through logic, validate assumptions, and refine their solutions. Developers get immediate feedback that improves both the code and their understanding of the code instead of waiting for human reviewers.

Beyond code completion, GitHub Copilot Chat acts as a collaborative reviewer. It boosts developer confidence and accelerates actionable reviews.

85% of developers felt more confident in code quality; reviews completed 15% faster.

Talent Attraction & Retention — 88% Maintain Flow State
Top engineering talent thrives when they can stay in flow, keep focus, maintain creativity, and remain uninterrupted. GitHub Copilot helps developers maintain this state by reducing context switching and minimizing frustration.

Developers stay longer when they feel supported and empowered. They collaborate more effectively and contribute more meaningfully to strategic initiatives. This cultural impact is often one of the most overlooked outcomes of GitHub Copilot adoption.

88% of developers reported maintaining flow state with GitHub Copilot Chat.

Of course, even with strong productivity gains, leaders must ensure that AIgenerated code meets enterprise standards. That’s where validation practices come in.

Check GitHub Copilot's Work
GitHub Copilot is powerful, and like any tool, GitHub Copilot performs best when paired with strong engineering discipline. Enterprises reinforce accuracy and compliance by combining GitHub Copilot with established review processes, automated testing, and security scanning.

GitHub Copilot is powerful, but validation ensures accuracy and compliance. Best practices include:

• Use GitHub Copilot Chat to explain suggestions.

• Review for functionality, security, readability, maintainability.

• Apply automated tests, linting, code scanning, IP scanning.

Leaders will then turn their attention to the next critical area, security and intellectual property protection, when validation is in place.

Security — Public Code Filter & LoC Metrics
Enterprises need assurance that AIgenerated code is safe, compliant, and free from IP risk. GitHub Copilot’s public code filter and lineofcode metrics provide that visibility.

GitHub Copilot suggestions are synthesized, not copied. Administrators can enable filters and track LoC metrics to safeguard IP and compliance.

For deeper insights into GitHub Copilot’s use cases, core features, and real-world implementation, contact DragonSoft, an authorized GitHub partner, for dedicated support.

We provide a comprehensive, end-to-end service for GitHub Copilot, covering everything from initial assessment and solution design to deployment, training, and ongoing maintenance. We ensure your team doesn’t just adopt GitHub Copilot, but leverages it effectively and securely.

🌐 Website: www.hkdsdtech.com

📞 Phone: +852-51679050

✉️ Email: marketing@hkdsdtech.com