Software supply chain security

Supply chain security involves securing everything that goes into your software, including first-party code, third-party libraries, and configuration files. It is critical because attackers increasingly target the "weak links" in open-source dependencies or exposed secrets to gain unauthorized access to enterprise systems.

Common software supply chain attacks include compromising popular open source packages, inserting malicious code into build scripts or CI/CD pipelines, tampering with artifacts in registries, and abusing unverified third‑party services. 

In dependency‑focused attacks, adversaries may publish malicious updates to widely used libraries or exploit known vulnerabilities like Log4Shell, instantly impacting thousands of applications that transitively rely on the affected component. 

Other attack patterns focus on the development and delivery process itself—abusing compromised developer credentials, manipulating build environments, or poisoning artifacts so that every downstream consumer inherits the compromise. 

Because these attacks exploit existing trust relationships, they can remain undetected for long periods and are often discovered only after widespread damage has occurred, making prevention and early detection critical.

Strong software supply chain security starts with comprehensive inventory and governance: maintain an up‑to‑date view of all software components, enforce clear policies for third‑party usage, and conduct regular vulnerability scanning across your environment. 

Complement this with proactive vendor and OSS evaluation, continuous monitoring and threat intelligence, and a well‑defined incident response plan so you can react quickly when high‑profile vulnerabilities or breaches emerge. 

At the development level, integrate security into the SDLC with code review, automated testing, and developer training that emphasizes code quality and secure use of dependencies. 

Adopting frameworks like SLSA or related industry standards helps structure your efforts, while focusing on new code quality—sometimes described as quality at the source or a focus on new code—lets you enforce strong gates on every change without being blocked by legacy issues.

Most SCA tools return a list of the vulnerabilities in your dependencies. SonarQube adds reachability analysis, which shows whether your code calls the vulnerable function, and Advanced SAST, which traces data flow from your code into third-party libraries. Together they cut noise and show which fixes reduce risk. SonarQube also extends the same workflow to the container images you ship.

Reachability analysis checks whether your code calls the vulnerable function in a dependency. A CVE in a library you import is not always exploitable in your application, so SonarQube flags the reachable ones for prioritization in the interface and in reports. You fix the vulnerabilities your code can reach before the ones it cannot. Reachability analysis is available for Java/Kotlin, Python, and C#/VB.NET.

Yes, in open beta. Container scanning checks the images you build and ship for known vulnerabilities and malicious packages, including operating system packages, language runtimes, and libraries that never appear in your repository. You run the scanner locally or in CI, and results appear under Container images in SonarQube Cloud next to your code and dependency risks. The scanner can fail a build at a severity you set. Container scanning is included with SonarQube Advanced Security at no additional cost.

Not yet. Container scanning is in open beta on SonarQube Cloud, for the Team and Enterprise plans with SonarQube Advanced Security. Support for SonarQube Server is planned.