Sonar's latest blog posts
Announcing SonarSweep: Improving training data quality for coding LLMs
Recent research from Anthropic has shown that even a small amount of malicious or poor quality training data can have a massively negative impact on a model’s performance, exposing users to significant security and quality issues.
Visual Studio Code Security: Finding New Vulnerabilities in the NPM Integration (3/3)
It's time to wrap up our series on the security of Visual Studio Code with new vulnerabilities in the NPM integration, bypassing the Workspace Trust security feature.
Read article >
SonarQube Server 10.3 Release Announcement
The new SonarQube Server 10.3 release is out now, including Secrets Detection at the Source, Code Quality Taxonomy & Clean as You Code Updates, Automate Provisioning GitHub Projects and Teams, 2023 CWE Top 25 Report, the Blazor Framework, and Stronger Security.
Read article >
Get new blog posts delivered directly to your inbox!
Stay up-to-date with the latest Sonar content. Subscribe now to receive the latest blog articles.
Visual Studio Code Security: Markdown Vulnerabilities in Third-Party Extensions (2/3)
We took a look at the security of the most popular code editor, Visual Studio Code! This blog post covers vulnerabilities our researchers discovered in third-party extensions.
Read article >
Sonar's Scoring on the Top 3 C# SAST Benchmarks
Sonar's Scoring on the Top 3 C# SAST Benchmarks
Read blog post >
Visual Studio Code Security: Deep Dive into Your Favorite Editor (1/3)
We took a look at the security of the most popular code editor, Visual Studio Code! This blog post covers common risks and attack surfaces so you know what to expect when using it.
Read article >
Linux Foundation Chat: Open Source & Code Quality
Linux Foundation Executive Director Jim Zemlin joins Sonar Founder and co-CEO Olivier Gaudin to discuss Code Quality, open-source development, cybersecurity, and more!
Read article >
Shifting Right for Secure Platforms and DevOps
Dev tooling is not only helping shift issues left, but the tools also help identify issues that happen later, or to the right, in the development lifecycle. Like detecting secrets before they go into production or platform configuration issues.
Read article >
Younger open source maintainers are significantly more likely to use AI-based coding tools
Those who are not using AI-based coding tools mostly have no plans to use them in the future either, with 45% selecting that option and only 6% not using them today, but planning to in the future.
Read article >
Highlights from Hexacon 2023
Last week, members of our AppSec and Vulnerability Research teams attended the Hexacon in Paris to learn, share, and network. Read more about our highlights.
Read article >
What is Code Quality?
If you’ve followed us for a while, you most likely noticed that we changed the way we describe what we do. It feels like in the last couple of years, we finally managed to settle on what we had been looking for from the beginning: Code Quality. But what is Code Quality, and what does it encompass?
Read blog post >
Security Vulnerabilities in CasaOS
We recently uncovered two critical code vulnerabilities in the personal cloud system CasaOS. Let's see what we can learn from them.
Read article >