Sonar's latest blog posts

Featured Post

Announcing SonarSweep: Improving training data quality for coding LLMs

Recent research from Anthropic has shown that even a small amount of malicious or poor quality training data can have a massively negative impact on a model’s performance, exposing users to significant security and quality issues.

Read More
https://assets-eu-01.kc-usercontent.com:443/55017e37-262d-017b-afd6-daa9468cbc30/c4c32669-0e01-4074-926a-1b257686a90c/sonarsweep_blog_or_press_featured_with_mark__2x.webp
Image for Using and Understanding SonarQube Server for Code Coverage
Blog post

Using and Understanding SonarQube Server for Code Coverage

One critical metric to gauge the effectiveness of your code testing efforts is code coverage. SonarQube Server, a powerful static code analysis solution, integrates seamlessly with code coverage tools, empowering developers to write cleaner, more secure, and thoroughly tested code.

Read article >

Image for Securing Developer Tools: Unpatched Code Vulnerabilities in Gogs (1/2)
Blog post

Securing Developer Tools: Unpatched Code Vulnerabilities in Gogs (1/2)

We discovered 4 critical code vulnerabilities in Gogs, a source code hosting solution, which are still unpatched. Read about the details and how to protect yourself.

Read article >

Get new blog posts delivered directly to your inbox!

Stay up-to-date with the latest Sonar content. Subscribe now to receive the latest blog articles.

I do not wish to receive promotional emails about upcoming SonarQube updates, new releases, news and events.

By clicking “Sign up”, you consent to receive email communications from SonarSource containing blog updates, product news, and other relevant content. We will store and process your personal data for this purpose as described in our Privacy Policy. You can withdraw your consent at any time by clicking the unsubscribe link in our emails or by contacting us in accordance with the Privacy Policy.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Image for The True Cost of Bad Code in Software Development
Blog post

The True Cost of Bad Code in Software Development

Despite advances in technology and methodologies, the costs associated with fixing bad code continue to escalate, impacting businesses financially and operationally. But what is bad code, what are the clear markers of its negative impact, and how can organizations overcome it?

Read article >

SonarQube 10.6 logo
Blog post

SonarQube Server 10.6 Release Announcement

The 10.6 release of SonarQube Server includes some significant changes, such as autoscaling in Kubernetes, AutoConfig for C and C++ projects, support for running in a FIPS-enforced environment, set rule priority to uphold your coding standards, easy setup of monorepos, monitoring the time it takes to upgrade, and expanded library coverage for AI/ML developers.

Read article >

Image for Green Coding with Code Quality - A Recap of ecoCode Challenge Paris 2024
Blog post

Green Coding with Code Quality - A Recap of ecoCode Challenge Paris 2024

ecoCode Challenge Paris represents an opportunity to unite innovation and sustainable coding. As a proud sponsor, we are excited to see how SonarQube Server is empowering developers to prioritize environmental sustainability in their projects.

Read article >

Image for Re-moo-te Code Execution in Mailcow: Always Sanitize Error Messages
Blog post

Re-moo-te Code Execution in Mailcow: Always Sanitize Error Messages

Our research team discovered two vulnerabilities in mailcow, an email server solution. Attackers could compromise an instance, impersonate users, and steal emails.

Read article >

Image for Integrating SonarQube Cloud with Amazon CodeCatalyst for Code Analysis
Blog post

Integrating SonarQube Cloud with Amazon CodeCatalyst for Code Analysis

Sonar recently announced the integration of SonarQube Cloud with Amazon CodeCatalyst. This blog post guides you through integrating SonarQube Cloud, a cloud-based Code Quality solution, with Amazon CodeCatalyst.

Read blog post >

Image for An Open Letter to Sonar[Qube] Users
Blog post

An Open Letter to Sonar[Qube] Users

Sonar’s new President of Field Operations introduces herself and reiterates the company's continued commitment to enabling organizations to succeed.

Read blog post >

Image for mXSS: The Vulnerability Hiding in Your Code
Blog post

mXSS: The Vulnerability Hiding in Your Code

XSS is a well-known bug class, but a lesser-known yet effective variant called mXSS has emerged over the last couple of years. In this blog, we will cover the fundamentals of this XSS variant and examine how you can protect against it.

Read article >

Image of deeper SAST by Sonar
Blog post

Find Deeply Hidden Security Vulnerabilities with Deeper SAST by Sonar

This post delves into an actual Jenkins vulnerability to understand the intricacies of deeper SAST for detecting deeply hidden code vulnerabilities. It illustrates how deeper SAST works and explains its impact on keeping your code clean and free of these serious issues.

Read article >

Image for Parallel Code Security: The Challenge of Concurrency
Blog post

Parallel Code Security: The Challenge of Concurrency

Parallelism has been around for decades, but it is still a source of critical vulnerabilities nowadays. This blog post details a severe vulnerability in the remote desktop gateway Apache Guacamole, highlighting the security risks of parallelism.

Read article >