This guide will show that achieving compliance doesn’t just take an audit; it's a necessary mindset in service of building high-quality software.
Learn more >
Developed by Atlassian, Jira empowers teams to plan, execute, and monitor projects with real-time transparency and efficiency.
Learn more >
A software codebase is the complete collection of human-readable source code, configuration files, build scripts, tests, and related assets needed to build and run a software system.
Learn more >
This guide provides a clear overview of the open source licensing landscape, helping you make informed decisions and build maintainable code with confidence.
Learn more >
Quality assurance in software development refers to the process of ensuring that a software product meets specific operational standards and performs its intended functions effectively, efficiently, and reliably.
Learn more >
Explore what Azure DevOps is and learn why it stands out as the trusted solution for professional software teams and enterprises demanding secure, scalable code management.
Learn more >
Autoscaling is a critical feature in large-scale server and cloud computing that dynamically adjusts the number of computing resources allocated to an application based on its current demand.
Learn more >
This guide provides a comprehensive overview of the DevSecOps framework. You will understand why security is no longer a hurdle to clear, but a shared responsibility that drives quality and innovation from the very beginning.
Learn more >
GitHub is the world’s leading DevOps platform for version control, collaborative software development, and Continuous Integration (CI) pipeline management.
Learn more >
GitLab is the all-in-one DevOps platform trusted by modern teams for source code management (SCM), continuous integration (CI), continuous deployment (CD), and robust developer workflow automation.
Learn more >
Code scanning is an automated process that uses static analysis to examine source code without executing it to identify potential bugs, security vulnerabilities, compliance issues and violations of coding standards.
Learn more >
This guide brings together the essential knowledge, frequently searched questions, and practical skills needed to understand and master C—a language synonymous with speed, efficiency, and hardware control.
Learn more >
The SonarQube MCP Server is the purpose-built solution to this paradox. It is not just another tool but an essential bridge that brings SonarQube’s trusted, independent static analysis directly into the conversational workflow of AI-native IDEs.
Learn more >
Audit trailing is a foundational practice in modern software development that enables organizations to maintain transparency, accountability, and compliance across all phases of the software lifecycle.
Learn more >
Vulnerability management in software development refers to the systematic, proactive process of identifying, assessing, prioritizing, and mitigating security vulnerabilities throughout the software development lifecycle.
Learn more >
Platform engineering is an approach in software development that focuses on creating a robust and efficient ecosystem for developers.
Learn more >
This guide will show you how to install the SonarQube for IDE plugin and connect it to SonarQube Cloud. Similar steps can be used for connecting to SonarQube Server.
Learn more >
By pairing Copilot’s speed with SonarQube’s rigorous code reviews directly within the Visual Studio Code editor, development teams can create a workflow that is both highly productive and robustly secure.
Learn more >
AI is transforming how we code, especially for massive company systems. Using AI responsibly—through automatic reviews and mandatory unit tests for AI-generated code—brings big benefits to your large codebases.
Learn more >
This article explores why this shift is happening and how it affects development teams and software quality.
Learn more >
This guide will explore the key requirements of each memorandum and show how SonarQube delivers practical, actionable solutions for federal agencies using AI in their code development processes.
Learn more >
An In-Depth Guide to setting up SonarQube IDE Extension for VS Code and apply AI CodeFix
Learn more >
We'll discuss how to build LLM integrations that aren’t limited to a single provider, giving businesses the freedom to choose the best tools for their needs.
Learn more >
As development teams start using these IDEs, it ’s more important than ever to focus on creating software that is reliable, secure, and easy to maintain.
Learn more >
AI CodeFix scans your code, identifies issues, and suggests fixes, all while seamlessly integrating into your development environment.
Learn more >
We'll walk through how to configure Claude Sonnet 3.7 for your organization, and provide feedback to continuously improve the process.
Learn more >
In this article, we’ll walk you through how to set up and optimize SonarQube’s Connected Mode for IntelliJ
Learn more >
Software Composition Analysis (SCA) is an automated process in software development that identifies, analyzes, and manages open-source components within applications to mitigate security risks and ensure compliance.
Learn more >
Vulnerability management involves identifying, evaluating, prioritizing, and addressing security weaknesses in an organization's software supply chain, essential for mitigating risks, ensuring compliance, and securing application development.
Learn more >
Software supply chain security comprises proactive and reactive practices to manage risks from creation to distribution, emphasizing vital tools, processes, and open source components.
Learn more >
A software bill of materials (SBOM) is a list of all components, libraries, and dependencies within a software application to manage security risks and improve transparency.
Learn more >
Proactive strategies in software development involve integrating security practices throughout the SDLC and actively evaluating open source packages to minimize risk from vulnerabilities.
Learn more >
Open source packages provide developers with pre-written code for common functionalities, saving time and effort during development.
Learn more >
Cybersecurity regulatory compliance involves government regulations aimed at securing software development and supply chains for organizations providing software to federal agencies.
Learn more >
Application security posture management (ASPM) involves continuously assessing, monitoring, and improving the security of an application by identifying and mitigating potential vulnerabilities and security risks.
Learn more >
Threat intelligence involves collecting, analyzing, and using data about current and potential cyber threats to inform decisions and proactively defend against attacks, especially in the context of open source software.
Learn more >
SLSA (Supply Chain Levels for Software Artifacts) sets industry standards for simplifying software supply chain security with checklists for producers and a common language for consumers to ensure package security.
Learn more >
The OpenSSF Scorecard, created by the Open Source Security Foundation (OpenSSF), assesses software security practices to help improve and evaluate the safety of open source packages.
Learn more >
Open source maintainers are crucial for developing and keeping open source projects functional, secure, and up-to-date by managing code, bugs, workflows, documentation, and community.
Learn more >
These tools promise to take the frustration out of debugging and empower developers to focus on building innovative solutions.
Learn more >
Imagine agents powered by advanced neural networks, moving beyond simple task automation to become genuine collaborators in software development.
Learn more >
Proper error handling ensures your programs can gracefully navigate unforeseen situations without crashing or compromising the user experience.
Learn more >
In this article, we’ll explore practical strategies for identifying and prioritizing the most organizationally important code issues.
Learn more >
Sonar AI Code Assurance relève ces défis en garantissant que le code généré par l'IA respecte des normes élevées en matière de qualité, de sécurité et de conformité, adaptées spécifiquement à ses caractéristiques et exigences uniques.
Learn more >
With the recent announcement of the SonarQube Free tier, developers now have easy access to professional-grade code analysis tools—no infrastructure setup or software installation required. This guide is designed to help you navigate the features of SonarQube Cloud and integrate it into your workflow seamlessly.
Learn more >
Secure coding is the practice of developing software with a focus on security at every stage, ensuring that applications are resilient against attacks and free from vulnerabilities. It involves writing code that protects data and maintains the integrity, confidentiality, and availability of information, the core principles known as the CIA triad.
Learn more >
Application security in software development refers to the process of integrating robust security measures throughout the software development lifecycle to protect applications from threats that could compromise their integrity, confidentiality, and availability.
Learn more >
Artificial Intelligence is evolving into a formidable partner for developers seeking enhanced productivity and efficiency. Delve into the core aspects of AI-driven software development, exploring the tools, technologies, and practices that can amplify your coding prowess.
Learn More >
AI code generation involves using software tools, powered by Artificial Intelligence (AI) and Machine Learning (ML), to write computer code. Learn about the cutting-edge technology that is being utilized by developers and companies alike.
Learn More >
AI coding assistants in software development are advanced tools that enhance the coding process using artificial intelligence and machine learning. These assistants help with code suggestions, debugging, and auto-completion, improving efficiency throughout the development process.
Learn more >
Code coverage is a metric used in software testing to measure the degree to which the source code of a program is executed during testing. It aids in identifying the extent to which the source code is being exercised, allowing you to acquire a better awareness of your testing efforts and where extra testing may be required.
Learn More >
In the software development world, monorepos have become a popular choice for managing codebases. But what exactly is a monorepo, and why are so many companies making the switch? In this guide, we'll explore their ins and outs.
Learn More >
Static Code Analysis is a vital tool for ensuring code safety and protecting against common pitfalls. In this guide, you’ll learn about static code analysis and will walk through steps on how to run it using SonarQube Server.
Learn More >
Ensuring proper code quality and consistency is a vital but tedious job when done manually. With SonarQube Server’s pull request and branch analysis, it can be a breeze. In this article, you will be guided through how pr and branch analysis improves the CI/CD pipeline and how to automate it with GitHub Actions.
Learn More >
SonarQube Cloud helps you uncover bugs and security weaknesses early in the development cycle, saving you time, money, and reputation. In this comprehensive guide to using SonarQube Cloud for Java code static analysis, you will walk through the setup, analysis, results, and issue resolution before they cause problems.
Learn More >
SonarQube Server Enterprise Edition offers robust capability to manage code quality for large organizations with complex deployments. In this tutorial, you will walk through the steps to deploy SonarQube Server in an Amazon Elastic Kubernetes Services (EKS) cluster with a Helm chart for a scalable, automated, and efficient solution.
Learn More >
Leaked secrets are a dangerous vulnerability risk that most developers have mistakenly exposed at least once. But by using SonarQube for IDE with SonarQube Cloud or SonarQube Server, you can catch secrets in the IDE before they are exposed. In this article, you’ll walk through how secrets detection works with SonarQube for IDE, SonarQube Cloud, and SonarQube Server.
Learn More >
DevOps is a collaborative approach to software development and operations that emphasizes the integration and automation of processes, tools, and teams to enable the continuous delivery of high-quality software products.
Learn More >
SDLC (Software Development Life Cycle) is a structured and systematic approach to developing software, encompassing all phases from initial planning and requirements gathering to deployment and maintenance, ensuring a well-managed and efficient development process.
Learn More >
Infrastructure as Code (IaC) is a revolutionary approach that allows you to automate, standardize, and streamline infrastructure management, unlocking unprecedented efficiency, reliability, and scalability in your development workflows.
Learn More >
CI/CD is a set of practices that automate the process of building, testing, and deploying software. It helps to improve the quality and speed of software delivery.
Learn More >
Technical debt refers to the future costs of rework or maintenance that arise from prioritizing speed and quick fixes over code quality in software development, with the debt accumulating over time and requiring resources to be paid off, making it crucial to address and minimize from the start of a project.
Learn More >
Debugging is the process of tracking down and eliminating issues in software applications such as bugs and vulnerabilities that may arise due to bad coding, architecture, or implementation.
Learn More >
Refactoring is the process of improving existing code by restructuring its internal design without changing its external behavior, aiming to enhance understandability, modifiability, and maintainability while reducing the risk of introducing bugs and technical debt.
Learn More >
SAST (Static Application Security Testing) is a software testing technique used to identify security vulnerabilities in the source code of an application without executing it, helping developers find and fix potential issues early in the development process.
Learn More >
A linter is a developer tool that analyzes source code for errors, vulnerabilities, and stylistic issues to improve code quality.
Learn More >
"Shift left" is a practice that involves moving critical development practices earlier in the software development lifecycle (SDLC).
Learn more >
OWASP is a nonprofit entity aimed at bolstering the security of software through a collaborative platform where security experts and developers contribute.
Learn More >
Code quality describes the general evaluation of a piece of software code's effectiveness, reliability, and maintainability.
Learn More >
Code smells are warning signs in your code that hint at deeper issues. These aren't errors and the code will still work, but they can make future development harder and increase the risk of bugs.
Learn More >
Code review is a systematic software quality assurance technique for developers in which the code is reviewed to find and fix errors, improve code quality, and enforce coding standards.
Learn More >
A static code analysis tool performs an examination of code without running it, aiming to detect potential bugs, security vulnerabilities, and stylistic inconsistencies; helping developers save valuable time that would otherwise be spent on testing and merging code at later stages.
Learn More >
What does a linter do, and what are the benefits of using one? From ensuring error-free code that is secure, consistent, and maintainable, to the impact on developers themselves a linting solution is an invaluable tool for every developer.
Learn More >
Source code is made up of the instructions developers write to tell a computer what to do, and it’s fundamental to software development.
Learn More >
Open source software fuels the backbone of modern technology, from personal projects to enterprise solutions, by providing accessible source code for examination, modification, and redistribution.
Learn More >
Source code management (SCM) streamlines software development by organizing changes to code, ensuring accountability and efficiency throughout the process.
Learn More >
Cyclomatic complexity serves as a vital gauge in computer science, quantifying a program's complexity by counting its independent paths.
Learn More >
An Integrated Development Environment (IDE) is a comprehensive software application designed to assist developers in writing, compiling, and debugging their code efficiently.
Learn More >
The rapid growth of generative AI and large language models introduces new security risks that are challenging to address due to the novelty of the field compared to established domains like web application security.
Learn More >
Code Quality is code that’s easily understandable, portable, and capable to change through structure and consistency but remains maintainable, reliable, and secure for performance demands.
Code Quality is well-documented coding standards that are clear and concise for increasing developer collaboration and communication.
A clean codebase simplifies the principles and processes to introduce changes to your code allowing business goals and objectives to be prioritized. Ensuring code readability improves team collaboration, communication, and code review processes across your enterprise.
Code Quality as you write maintainable, readable quality code. Sonar’s tool kit allows you to continually review and make incremental clear quality improvements as you edit or write code. Deliver high-quality, efficient code standards that benefit the entire team or organization.
Clean Code is secure through early detection and feedback of security vulnerabilities and hotspots during code review.
Clean Code creates and sustains reliability. When your software is reliable, anywhere and anytime, it creates trust among your teams and customers.
Clean Code makes maintenance easy. A codebase that is maintainable enables an optimized development workflow for more scalable software.
