Sonar's latest blog posts
The Coding Personalities of Leading LLMs
Make smarter AI adoption decisions with Sonar's latest report in The State of Code series. Explore the habits, blind spots, and archetypes of the top five LLMs to uncover the critical risks each brings to your codebase.
Use 3rd-party plugins at your own risk
If you're using 3rd-party plugins for SonarQube Server, you're obviously already aware of the benefits. With this blog post, we want to make sure you're also aware of the risks. Because there are risks.
Read Blog >
Launching ‘Secret Detection’ to keep your Cloud ‘Secrets’ safe
Learn how developers can safeguard their cloud 'secrets' from publicly leaking and take charge of their Code Security with SonarQube for IDE.
Read Blog >
Get new blogs delivered directly to your inbox!
Stay up-to-date with the latest Sonar content. Subscribe now to receive the latest blog articles.
How Clean Code Practices Help You Retain Your Development Talent
It can be challenging to maintain good coding vibes when your team or company often prioritizes feature delivery over code quality. If your developers are never allowed the time to work on new and exciting things they may eventually find somewhere else to bring their coding talents to.
Read Blog >
Zimbra 8.8.15 - Webmail Compromise via Email
We discovered critical code issues in Zimbra, a popular enterprise webmail solution, that could lead to a compromise of all emails by an unauthenticated attacker.
Read Blog >
Clean As You Code essentials - What are Quality Profiles and Quality Gates?
Learn how the functionality of Quality Profiles and Quality Gates come together to enable the SonarSource Clean As You Code methodology.
Read Blog >
Etherpad 1.8.13 - Code Execution Vulnerabilities
We discovered two code execution vulnerabilities that affected Etherpad servers and data. Learn more about the technical details and how to avoid such coding issues.
Read Blog >
Enterprise-ready: Authentication & Authorization with SonarQube Server (LDAP, SSO & more)
Discover how SonarQube Server can integrate with your existing enterprise setup (LDAP, SSO & co.) for user authentication and authorization.
Read Blog >
CiviCRM 5.22.0 - Code Execution Vulnerability Chain Explained
We discovered critical code vulnerabilities in CiviCRM, a popular CRM plugin for Wordpress, Joomla and Drupal. Learn more about how to find and patch these issues.
Read Blog >
7 more reasons to upgrade to SonarQube Server 8.9 LTS
SonarQube Server 8.9 LTS is here! Not every improvement could be mentioned in the release announcement, so check out these LTS easter eggs that make this the Best LTS Ever.
Read Blog >
Broken pipelines for everyone!
With SonarQube Server 8.9 LTS, SonarSource has made failing the pipeline available for everyone, using any CI you want. But with great power comes ... well, you know. In this post you'll learn what went into the decision to make this available and what you'll want to watch out for when you use it.
Read Blog >
Grav CMS 1.7.10 - Code Execution Vulnerabilities
We responsibly disclosed two code execution vulnerabilities in Grav CMS, one of the most popular flat-file PHP CMS in the market. Let’s see what we can learn from them and discuss their patches!
Read Blog >