Sonar's latest blog posts
The Coding Personalities of Leading LLMs
Make smarter AI adoption decisions with Sonar's latest report in The State of Code series. Explore the habits, blind spots, and archetypes of the top five LLMs to uncover the critical risks each brings to your codebase.
Seven Habits of Highly Effective AI Coding
Massive codebases can hugely benefit from developers using AI coding tools, but they must be harnessed in a responsible way. Sonar CEO, Tariq Shaukat, shares what coding "habits" organizations should adopt.
Read article >
Data in Danger: Detecting Cross-Site Scripting in Grafana
Learn how SonarQube detected a Cross-Site Scripting (XSS) vulnerability in Grafana, a popular open-source data observability platform.
Read article >
Get new blogs delivered directly to your inbox!
Stay up-to-date with the latest Sonar content. Subscribe now to receive the latest blog articles.
Introducing support for Rust in SonarQube
The popularity of the Rust programming language is growing. Rustaceans have been asking for SonarQube to support Rust and now it's here!
Read article >
MISRA C++:2023 Compliance for Auto Safety and Reliability
MISRA coding guidelines are a standard for automotive and other safety critical systems. SonarQube helps C++ developers deliver MISRA C++:2023 compliant apps with MISRA Compliance Early Access available in SonarQube Server Enterprise and Data Center.
Read article >
New! Architecture as Code in SonarQube
Sonar recently introduced new architecture as code functionality in SonarQube. You can now formally define the architecture of your projects and SonarQube will automatically verify when code strays from your defined architecture preventing architectural drift.
Read article >
New Spring framework rules in SonarQube
SonarQube has introduced new rules to improve code quality and enforce best practices in Spring Framework applications. These rules focus on various aspects of Spring development, including event handling, scheduling, data and MVC, caching, dependency injection, and testing.
Read article >
SonarQube Server 2025 Release 2 Announcement
The new SonarQube Server 2025 Release 2 contains significant enhancements across code quality, code security, and issue remediation with AI CodeFix. Read on to learn more about these great new capabilities.
Read article >
Diving Into JumpServer: Attacker’s Gateway to Internal Networks (2/2)
In this second part, we delve into JumpServer's code execution vulnerabilities we discovered, and understand their root causes. Learn the importance of threat modeling and adherence to best practices can safeguard your own applications.
Read article >
Diving Into JumpServer: Attacker’s Gateway to Internal Networks (1/2)
Bastion host offers a centralized point of access and control to an internal network, but what happens when this gateway itself is compromised? In this blog series, we will dive into vulnerabilities we found in JumpServer.
Read article >
Announcing SonarQube Advanced Security
SonarQube Advanced Security includes Software Composition Analysis (SCA) and advanced Static Application Security Testing (SAST) extending SonarQube's core security capability.
Read article >
Beware the Cookie Monster: Cyberhaven Extension Vulnerability Allowed Cookie Theft
We discovered a vulnerability in Cyberhaven's browser extension that allowed attackers to steal arbitrary cookies from their victims.
Read article >