Sonar Blog

Home

Sonar's latest blog posts

Featured Post

Building Confidence and Trust in AI-Generated Code

To tackle the accountability and ownership challenge accompanying AI-generated code, we are introducing Sonar AI Code Assurance

Read More
AI generated code is detected in project
Image of preventing secrets in code
Blog post

Sonar keeps your secrets from leaking … unlike that "trusted" friend from grade school

What are hard coded secrets? Why do you care if secrets are hidden in your code? How does Sonar help prevent secrets from getting into your code, entering your repository, and leaking out from your CI/CD pipeline? In this post, Product Manager, Alex Gigleux, answers all your questions.

Read blog post >

Image for Sonar is “On the Radar”: New Omdia Report
Blog post

Sonar is “On the Radar”: New Omdia Report

Omdia — an analyst firm that provides decades of industry experience, world-class research and consultancy, and actionable insights in over 200 markets — has published research about Sonar, our solutions, and recent innovations of deeper SAST and zero-configuration automatic analysis for C/C++. The research digs into why Sonar should be on your radar and also takes a look at the market view as well as from a current positioning.

Read article >

Get new blogs delivered directly to your inbox!

Stay up-to-date with the latest Sonar content. Subscribe now to receive the latest blog articles.

I do not wish to receive promotional emails about upcoming SonarQube updates, new releases, news and events.

By submitting this form, you agree to the storing and processing of your personal data as described in the Privacy Policy and Cookie Policy. You can withdraw your consent by unsubscribing at any time.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Image for Top issues in Java projects
Blog Post

Top issues in Java projects

Let's dig into the projects using Java as language and see, according to what SonarQube for IDE telemetry shows, that there are still lots of issues that appear in the huge list of analyzed projects.

Read blog post >

Image for Visual Studio Code Security: Finding New Vulnerabilities in the NPM Integration (3/3)
Blog post

Visual Studio Code Security: Finding New Vulnerabilities in the NPM Integration (3/3)

It's time to wrap up our series on the security of Visual Studio Code with new vulnerabilities in the NPM integration, bypassing the Workspace Trust security feature.

Read article >

SonarQube 10.3 Release Announcement Image
Blog post

SonarQube Server 10.3 Release Announcement

The new SonarQube Server 10.3 release is out now, including Secrets Detection at the Source, Clean Code Taxonomy & Clean as You Code Updates, Automate Provisioning GitHub Projects and Teams, 2023 CWE Top 25 Report, the Blazor Framework, and Stronger Security.

Read article >

Image for Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3)
Blog post

Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3)

We took a look at the security of the most popular code editor, Visual Studio Code! This blog post covers vulnerabilities our researchers discovered in third-party extensions.

Read article >

Image for Sonar's Scoring on the Top 3 C# SAST Benchmarks
Blog post

Sonar's Scoring on the Top 3 C# SAST Benchmarks

Sonar's Scoring on the Top 3 C# SAST Benchmarks

Read blog post >

Image for Visual Studio Code Security: Deep Dive into Your Favorite Editor (1/3)
Blog post

Visual Studio Code Security: Deep Dive into Your Favorite Editor (1/3)

We took a look at the security of the most popular code editor, Visual Studio Code! This blog post covers common risks and attack surfaces so you know what to expect when using it.

Read article >

Image for Linux Foundation Chat: Open Source & Clean Code
Blog post

Linux Foundation Chat: Open Source & Clean Code

Linux Foundation Executive Director Jim Zemlin joins Sonar Founder and co-CEO Olivier Gaudin to discuss Clean Code, open-source development, cybersecurity, and more!

Read article >

Image for Shifting Right for Secure Platforms and DevOps
Blog post

Shifting Right for Secure Platforms and DevOps

Dev tooling is not only helping shift issues left, but the tools also help identify issues that happen later, or to the right, in the development lifecycle. Like detecting secrets before they go into production or platform configuration issues.

Read article >

Image for Younger open source maintainers are significantly more likely to use AI-based coding tools
Blog post

Younger open source maintainers are significantly more likely to use AI-based coding tools

Those who are not using AI-based coding tools mostly have no plans to use them in the future either, with 45% selecting that option and only 6% not using them today, but planning to in the future.

Read article >