Deeper Analysis. Unmatched Security.

14-day free trial

Choosing to proceed means that you agree to the storing and processing of your personal data as described in SonarSource’s Cookie Policy. You can opt out of SonarSource communications at anytime.

Sonar respects your privacy. Choosing to proceed means that you agree to the SonarSource’s Privacy Policy.

SonarQube_General.svg

Deeper Analysis. Unmatched Security.

Uncover Hidden Code Vulnerabilities with SonarQube Server SAST

  • Comprehensive detection engine for code quality and security
  • Over 5000 rules for 35+ languages and frameworks
  • Deeper SAST coverage for Java, C#, and JavaScript/TypeScript
  • Branch Analysis and Pull Request decoration
  • Powerful secrets detection
  • Security Reports including OWASP, CWE Top 25, and PCI DSS
  • Regulatory release reports
  • Security Engine customization
  • Detection of injection flaws, cross-site scripting, deserialization issues and more
CODE SECURITY

benefits of deeper SAST

inpsect color-red-size-small

Find deeply hidden security issues

99% of software applications use and interact with the code in third-party libraries (dependencies). Deeper SAST from Sonar extends code analysis and scanning to cover the unknown parts of the code that are in the open-source dependencies. Scanning dependencies (libraries) allows Sonar SAST to extend the dataflow analysis and find deeply hidden security issues in code that other tools cannot find. Deeper SAST is available today for Java, C#, and JavaScript/TypeScript in SonarQube Server and SonarQube Cloud.

feedback blue-size-small

Accelerate secure development

SAST analysis of Pull Requests helps empower developers by shifting security left and presenting security vulnerabilities as early as possible in the process - when the code is fresh in mind and the fix is still easy. SAST is available by default with SonarQube Server and SonarQube Cloud and runs as part of a normal code analysis and integrates seamlessly with the DevSecOps pipeline.

secure blue-small

Reduce risk of security breaches

By implementing secure code development practices to strengthen the quality of the codebase, organizations can prevent malicious actors from exploiting vulnerabilities and stealing sensitive information. Sonar analyzers raise issues (including bugs and vulnerabilities) and security hotspots as it scans the code to detect security problems. Cloud secrets detection capabilities extend to include more rules that discover unintended hard-coded passwords, credentials, tokens, cloud access keys, API keys, cloud account/keys in the most popular cloud providers: AWS, GCP, Microsoft Azure, IBM, and Alibaba Cloud.


settings blue-size-small

Automate code scanning

Sonar SAST can scan large amounts of code quickly – saving time and money in the software development life cycle process. Automating code scanning with SAST helps improve the overall security posture of an application and reduces the reliance on manual code reviews, allowing developers to focus on remediation efforts while maintaining an efficient and secure development lifecycle.

secure blue-small

Code Security and compliance

Sonar provides comprehensive application security tracking and governance for the most complex projects with SAST. Dedicated reports track the application’s code security against standards such as OWASP Top 10, OWASP ASVS, CWE Top 25 (2021, 2020, and 2019), as well as PCI DSS.

quality assurance-blue-size-small

Comprehensive Detection Engine and coverage

Sonar provides code quality and security analysis for 30+ languages (and frameworks), with more than 5,100 out-of-the-box Code Quality rules. Sonar detects bugs and security flaws at the code level – source code, support code (including config code, infrastructure code, scripting, and test code), and third-party code, such as external dependencies and libraries – often exceeding a true positive rate (TPR) of 90%. Security coverage includes cross-site scripting, SQL injection, path injection, to secrets, IaC misconfigurations, phishing, and a variety of others.

Security analysis

Designed to detect and fix a wide range of code issues that can lead to bugs and security vulnerabilities, SonarQube supports over 35 programming languages and frameworks. Sonar's security analysis can help detect a broad range of security issues, such as SQL injection vulnerabilities, cross-site scripting (XSS) code injection attacks, buffer overflows, authentication issues, cloud secrets detection, and much more. In SonarQube Server Enterprise Edition, Data Center Edition, and SonarQube Cloud Enterprise Plan, our security rules are classified according to well-established security standards such as PCI DSS, CWE Top 25, OWASP ASVS, OWASP Top 10, STIG, and CASA.

categories of issues in code
checklist

Security hotspots > code review

Security hotspots are instances of security-sensitive code that require human review. Developers can learn to evaluate security risks and improve their understanding of secure coding practices by working with security hotspots. Hotspots are surfaced in the IDE and pull requests with data flow context so teams can triage potential risks quickly.

secure

Security vulnerabilities > code change/fix

Security vulnerabilities require immediate action. Sonar provides detailed issue descriptions and code highlights that explain why your code is at risk. Just follow the guidance, check in a fix, and secure your application. Quality Gates and CI/CD feedback help teams prioritize severity, map issues to OWASP and CWE, and accelerate remediation with actionable fixes using AI CodeFix.

Chase down the bad actors

Making sure user-provided data is sanitized before it hits critical systems (database, file system, OS, etc.) helps ensure your code security. Taint analysis tracks untrusted user input throughout the execution flow - across not just methods but also from file to file.

Visual Represents taint analysis

Sonar security & compliance reports

Security reports quickly give you the big picture of your code’s compliance with security standards. Available in SonarQube Server Enterprise Edition and Data Center Edition and in SonarQube Cloud Enterprise Plan, these security reports allow you to know where you stand compared to the most common security mistakes. Regulatory reports track the quality of each release and provide evidence that the code delivered meets the quality standards of the organization.

Reports include:

  • PCI DSS (versions 4.0 and 3.2.1) 
  • OWASP Top 10 (versions 2021 and 2017)
  • OWASP Mobile Top 10 (2024)
  • CWE Top 25 (versions 2024, 2023, 2022, 2021)
  • OWASP ASVS (version 4.0 with level 1 to 3)
  • STIG
  • CASA
See OWASP Top 10
Image

Your end-to-end SAST tool

Seamlessly integrate static analysis into your software development workflow. Use static application security testing (SAST) scans that analyze source code with data‑flow and taint analysis (sources and sinks).

DevOps and CI/CD tools

Integrating SAST into the DevOps and CI/CD pipelines empowers organizations to enhance the security posture of their software and ensure that vulnerabilities are identified early in the software development lifecycle. Code security analysis tools become an integral part of the development process and receive early real-time feedback as they commit code changes.  SonarQube integrations are supported for popular DevOps and CI/CD Platforms including GitHub, GitLab, Azure Devops, TravisCI, CircleCI, and Bitbucket. SonarQube provides native support for the most popular SCMs including Git , Subversion and community support for other popular SCMs such as CVS, Jazz RTC, Mercurial, TFVC.

Image

Pull request decoration

Get instant code review directly inside your pull request and development branches. Fix issues before they become problems, by detecting vulnerabilities and fixing security issues early in the software development life cycle (SDLC).

  • Implement a go/no-go quality gate to automatically fail CI/CD pipelines if code doesn't meet your standards
  • Review and prioritize code fixes directly within the DevOps Platform interface
  • Set up multiple quality gates for your monorepo with different projects to receive specific feedback messages for each project
  • Receive contextual guidance and remediation steps directly in your workflow, helping developers quickly understand root causes and apply the right fix the first time.

IDE Integration with SonarQube for IDE

  • Superior code quality tool capabilities right into developers’ code environments
  • Real-time analytical feedback
  • Code issue highlighting
  • Strict code quality standards, along with vulnerability issue details and remediation guidance
  • Customizable rules allow developers to code based on their specific requirements
  • Advanced flexibility allows developer adaptation and adoption across multiple supported languages

"The greatest impact it’s had has been that it has allowed us to focus our effort on making sure new code is clean instead of addressing technical debt, and it has given us the ability to standardize the quality of the codebase across the organization."

Bijay Mangaraj

Senior Vice President

ready to secure your code?

Start Your Free Trial Now