Introduction to SonarQube Hunter Agent

Your SonarQube static analysis catches issues like SQL injection and cross-site scripting before you ship. But what about intent-based flaws? For example, broken access control issues such as an insecure reference that allows users to swap out a file name to see something they shouldn't. Or a checkout flow that lets someone redeem the same discount code more than once? That's where SonarQube Hunter Agent comes in. Traditional algorithmic detection doesn't detect logic flaws like broken access or reusable discount codes. They live in the gap between what your code is supposed to do and what it actually does, and SonarQube's static analysis can't determine your code's intent. SonarQube Hunter Agent adds a deeper layer of review to close that gap. Behind the scenes, it works through a structured, multi-step process that analyzes your code's intent the way a security researcher works through an audit, complementing your SonarQube static application security testing (SAST) analysis. It runs on Sonar's infrastructure, so there's nothing to install, and it works with any language that SonarQube Cloud supports. SonarQube Hunter Agent applies a dedicated security playbook to your entire application, detecting a wide range of vulnerability categories in a single analysis. It uncovers those critical broken access control issues, like unauthorized privilege escalation or flawed authorization checks. It also finds complex business-logic errors and authentication flaws, such as missing rate limits or session management vulnerabilities. SonarQube Hunter Agent findings appear in your project's regular issue list, alongside every other issue. You triage, assign, comment on, and change their status the same way you always do— there's no new tool to learn. Each project where you enable SonarQube Hunter Agent also gets its own Hunter Agent page, giving you a single summary view of everything it's found. Attackers don't always need to find a break in your code to succeed. Often, they exploit the features you've already built, using them in ways you never intended, to compromise your system or steal data. SonarQube Hunter Agent gives you a deeper layer of intent verification, covering multiple categories of vulnerability that static analysis can't reach. To learn more, go to Sonar .com.