Code security
How SonarQube code coverage reporting works
Struggling with missing or incorrect coverage in SonarQube? Discover the four-stage coverage pipeline and the most common causes of 0% results and mismatched metrics.
Read article >
GPT-5.5’s biggest blind spot: the Java bugs your tests won’t catch
Sonar’s LLM Leaderboard reveals concurrency bugs in AI generated Java code that pass tests but break in production due to thread timing issues.
Read article >
When linting is not enough
Is linting enough for AI-generated code? Discover why deep static analysis, control flow, and taint analysis are critical to preventing vulnerabilities and architectural decay in agent-centric development.
Read article >
Claude Opus 4.7: An evaluation review & metrics benchmarks
Discover how Claude Opus 4.7 cuts code volume by 40% but increases vulnerability risks. See the full technical audit of bugs, complexity, and code smells.
Read article >
OpenAI GPT-5.5: An evaluation
Is OpenAI's GPT-5.5 safe for production? Explore our independent 4,444-task Java benchmark. See why its security is top-tier but its 'verification debt' is high.
Read article >
Why your supply chain attack surface is expanding
Supply chain attacks are spreading through dependencies and pipelines. Learn how attackers operate and how to protect your software early.
Read article >