I've been trying to get my team to adopt Amazon Q Developer for code reviews, especially for security scanning. The promise is fantastic, but I keep hitting a major snag: the vulnerability explanations are just... useless.
For example, it flagged a potential "path traversal" issue. The message was something like: `Security Issue Detected: Path Traversal. Severity: High. Review suggested.` That's it. No example of the vulnerable code path, no explanation of *why* the flagged pattern is risky in this context, and no clear remediation hint beyond "review." I'm left Googling the issue myself, which defeats the whole purpose of having an AI assistant.
How are you all handling this? As a designer who collaborates closely with devs, I need to understand the *why* behind a flag to advocate for a fix or to assess its real priority. Right now, I can't translate Q's output into a meaningful ticket or a convincing argument for my engineering team.
It feels like a classic UX issue—the tool identifies a problem but provides zero user-friendly context to act on it. For a high-severity issue, "Review suggested" is not an acceptable level of detail. Am I missing a setting somewhere, or is this just how it is? I'd love to hear if anyone has found a workaround or a better way to prompt it.