Featured Post
Uncovering hidden security vulnerabilities with deeper SAST
Security vulnerabilities can be hidden in your third-party dependency code. Uncover them with deeper SAST.
Read more -->
Blog
Sonar's latest blog posts
Blog post
A comprehensive guide to the dangers of Regular Expressions in JavaScript
A deep investigation into regular expression denial of service (ReDoS) vulnerabilities in JavaScript
Read blog post >
Blog post
Unzipping Dangers: OpenRefine Zip Slip Vulnerability
Extracting archives can be very dangerous. Read more about a critical Zip Slip vulnerability SonarCloud detected in the open-source application OpenRefine.
Read article >
Blog post
Sonar's Scoring on the Top 3 Java SAST Benchmarks
Enhancing SAST Detection: Sonar's Scoring on the Top 3 Java SAST Benchmarks
Read blog post >
Blog post
Source Code at Risk: Critical Code Vulnerability in CI/CD Platform TeamCity
Our Vulnerability Research team discovered a critical vulnerability in the popular CI/CD server TeamCity, which attackers could use to steal source code and poison build artifacts.
Read article >
Blog Post
Open Source Summit 2023
Open Source Summit 2023
Read blog post >
Blog post
5 Clean Code Tips for Reducing Cognitive Complexity
Understanding how Cognitive Complexity works will help guide you on where to focus your time. This blog dives into how this Sonar-exclusive metric was formulated to accurately measure the relative understandability of methods.
Read article >
Blog post
Remote Code Execution in Tutanota Desktop due to Code Flaw
Our Research team discovered critical code vulnerabilities in Proton Mail, Skiff, and Tutanota. This post covers an XSS vulnerability in Tutanota Desktop and how it can be prevented.
Read article >
Blog post
The new JDK LTS is out! Long live JDK 21! Well, for the next 8 years.
Let's check what the new Java JDK21 LTS brings
Read blog post >
Blog post
Enhancing Software Development Practices through SonarQube: A Path to Continuous Learning
With SonarQube, organizations can readily deploy workflows integrated directly into their pipelines to build on their teams’ skill sets and create resiliency to new risks.
Read article >
Blog post
Typing your JavaScript without writing TypeScript
TypeScript already understands JavaScript, but you can get more out of it when you add types to your JavaScript with JSDoc or TypeScript declaration files
Read blog post >
Blog post
Code Vulnerabilities Put Skiff Emails at Risk
Our Research team discovered critical code vulnerabilities in Proton Mail, Skiff, and Tutanota. This post covers the technical details of the XSS vulnerability in Skiff.
Read article >
Blog post
Security Guy TV Interview - Going Deeper with SAST and Clean Code
Sonar CEO, Olivier Gaudin, and Head of Research and Development, Johannes Dahse, meet with Security Guy TV’s Chuck Harold to discuss deeper SAST and the importance of Clean Code.
Read article >