(Debra Aniston is a DevSecOps engineer in an IT company that develops software products and web applications. Her team has found various coding…

SonarLint is an IDE extension that provides on-the-fly feedback to developers as they write code. It detects and highlights bugs, code smells, and security vulnerabilities directly in the editor. This matches the requirement of fixing issues before the code is committed by providing immediate feedback and clear remediation guidance. It helps developers "shift left," addressing security concerns early in the development lifecycle.

B. Arachni is a Dynamic Application Security Testing (DAST) scanner, which analyzes running web applications, not static code before commit.

C. OWASP ZAP is primarily a DAST tool used for penetration testing of running web applications, not for static code analysis in an IDE.

D. Tenable.io is a comprehensive vulnerability management platform for scanning infrastructure and applications, not an IDE-based tool for pre-commit code analysis.

1. SonarSource. (n.d.). What is SonarLint? SonarLint Official Documentation. Retrieved from https://www.sonarlint.org/

"SonarLint is a FREE and Open Source IDE extension that identifies and helps you fix quality and security issues as you write code."

2. Cornell University, Department of Computer Science. (n.d.). CS 5152: Software Engineering - Tools. Retrieved from https://www.cs.cornell.edu/courses/cs5152/2020sp/tools.html. This courseware lists SonarLint as a static analysis tool for improving code quality.