TL;DR overview
- Code security is no longer just the domain of security teams—modern developer tools bring security analysis directly into the IDE, enabling developers to find and fix vulnerabilities at the moment they are introduced.
- SonarQube for IDE provides real-time security feedback on 30+ languages, flagging injection vulnerabilities, insecure configurations, and secrets in code before they are even committed.
- Shifting security left—detecting vulnerabilities in the developer's environment rather than in production—dramatically reduces the cost and complexity of remediation, since issues are addressed while context is fresh.
- Tools like SonarQube for IDE are free and integrate with VS Code, Cursor, Windsurf, IntelliJ, and Visual Studio, making developer-led security accessible to teams of all sizes.
Hey SonarQube Server and SonarQube Cloud users! You now have a tool to own Code Security!
SonarSource has been hard at work for the last year to give you the tooling to review and improve your code security. We're glad to say that today you have at your fingertips unmatched precision and performance in SAST (Static Application Security Testing) analysis for five languages and counting.
We've been working to bring you Code Security for a couple years now, and those efforts took a giant leap forward this spring when we acquired RIPS Technologies. RIPS initially caught our eye with the depth and precision of their PHP analysis. Seeing that, we knew their depth plus our breadth - analysis of 27 languages - would make a great combination. We joined forces in May and immediately started work to combine our two approaches. Since then, we've re-engineered our detection of injection vulnerabilities from the ground up to incorporate the best of RIPS' approach and ours.
The result: today you have access to unparalleled precision in security analysis of Java, C#, PHP, Python and JavaScript code, with more languages to come.
I can say "unparalleled precision" because we've focused in this work on eliminating false positives. Old-school SAST tools aren't built for developers. They cast a very broad net, raising an issue for everything even remotely suspicious, and make an auditor sort it out. At SonarSource, we know developers don't have time for that. So we've made sure that when we raise an issue, you can be confident there's something to fix. At the same time, we haven't sacrificed performance; analysis is still extremely fast.
The best part is that you don't have to learn a new tool. These SAST advancements are part of what you already know and love: SonarQube Cloud and SonarQube Server. Vulnerabilities and Security Hotspots start in SonarQube Community Build and injection Vulnerabilities (taint analysis) is available in commercial editions. And they're available today. Getting started is as easy as making sure your Quality Profile (and your version!) is up to date.
By adding SAST to SonarQube Cloud and SonarQube Server, we've put the power to own Code Security in your hands. That represents a fundamental shift, and there's a lot more to say on the topic. I'll save that for the New Year. For now, enjoy the holidays and your new toy: SAST analysis built for developers.