Advanced SAST
Extends taint analysis to dependencies to uncover complex vulnerabilities:
- Dependency-aware data flow analysis
- Uncovers vulnerabilities others miss
- Fast and accurate
SONARQUBE ADD-ON
Advanced Security
Developer-first security for your first-party, AI-generated, and open source code, powered by advanced SAST and integrated SCA
TRUSTED BY OVER 7M DEVELOPERS AND 400K ORGANIZATIONS
SonarQube core security
SAST
Detect code vulnerabilities, early in development
Taint analysis
Cross-file data flow analysis to prevent injection attacks
IaC scanning
Secure cloud infrastructure configurations
Secrets detection
Prevent exposure of credentials, tokens, and keys
SCA
Comprehensive open-source risk & compliance management
- Vulnerability detection
- License management
- SBOM (Software Bill of Materials)
Deeper taint analysis
CVE detection
License management
SBOM
Deeper taint analysis
Dependency-aware taint analysis to find hidden security flaws
- Analyze your code's interactions with third-party libraries
- No configuration required
- No performance overhead
- Supports Java, C#, JavaScript, Typescript
Ecosystem support
SonarQube security reports
Comprehensive reporting for all security issues in all code
Actionable insights
Detailed code security findings with severity, trends, and remediation guidance
Rich dashboards
Visualize quality and security trends, and KPIs in unified dashboards
Compliance reports
Generate security reports for OWASP Top 10, CWE, PCI DSS, STIG, and more
Scheduled reports
Automate report delivery on daily, weekly, or monthly schedules
Integrated code quality and code security
SonarQube is an integrated code quality and security analysis platform that provides actionable intelligence to help build better software, faster.
Elevate code quality standards
Deliver robust, reliable, and maintainable code with fast, accurate analysis across all code
Core security: foundation for secure code
Includes SAST, taint analysis, secrets detection, IaC scanning for first-party and AI-generated code
Advanced Security add-on
Advanced Security extends to open-source code with advanced SAST and Software Composition Analysis (SCA)