Programming assistants based on Large Language Models (LLMs) assist developers in code generation and improve efficiency. These LLM-based programming assistants are prone to generate code with vulnerabilities. To mitigate security risk, existing approaches retrain an LLM with crafted data without vulnerabilities. However, retraining requires enormous computational costs and the accessible LLMs’ internal representation, often unavailable for LLMs deployed as distributed online services. Our previous work, CoSec, proposed a supervised co-decoding approach using base LLMs alongside a small-scale security-focused LLM fine-tuned with code changes before and after vulnerability fixing.

In this paper, we present CoSEFA, a programming assistant with CoSec as its core component for secure code hardening and error fixing. The front-end is a Visual Studio Code IDE extension with a dialogue interaction interface. The back-end handles users’ request for code generation, test case generation, etc., providing secure code generation and addressing three types of code generation errors. Experimental results showed that CoSEFA improved the generation security by 9.34% and functionality correctness by 11.2%, compared with the base LLM. Our user study showed that experienced developers rated CoSEFA as more useful than Copilot for security-related programming tasks, highlighting the importance of secure code generation.