Sonar's latest blog posts
Building Confidence and Trust in AI-Generated Code
To tackle the accountability and ownership challenge accompanying AI-generated code, we are introducing Sonar AI Code Assurance
Code Security Advent Calendar 2021
Our code security advent calendar is back for the sixth consecutive year. We will release daily challenges until December 24th, get ready to fill your bag of tricks!
Read Blog post >
10 Unknown Security Pitfalls for Python
In this blog post, we share 10 security pitfalls for Python developers that we encountered in real-world projects.
Read Blog post >
Agent 008: Chaining Vulnerabilities to Compromise GoCD
We discovered 3 more code vulnerabilities in the popular GoCD CI/CD system that can be chained by attackers to leak or modify internal code. Learn more in this blog post.
Read Blog post >
SmartStoreNET - Malicious Message leading to E-Commerce Takeover
Check out the details of a Cross-Site Scripting bug in the BBCode processing in SmartStoreNET and how it can be chained into arbitrary code execution!
Read Blog post >
Agent 007: Pre-Auth Takeover of Build Pipelines in GoCD
We recently discovered critical security issues in the popular CI/CD solution GoCD that can be exploited by unauthenticated attackers
Read Blog post >
Meet the new project experience for SonarQube Cloud
We are very pleased to announce that we have released a new project experience. It’s now available in SonarQube Cloud for all users. You’ll notice a few improvements the next time you open SonarQube Cloud.
Read Blog post >
Squirrel Sandbox Escape allows Code Execution in Games and Cloud Services
We discovered and reported a vulnerability in the Squirrel VM, written in C, that allows an attacker to escape the sandbox.
Read Blog post >
Supercharge your C++ analysis with SonarQube for IDE for CLion
This article talks about the powerful capabilities of the C++ analyzer with SonarQube for IDE and highlights some unique and interesting quality and security rules you might find useful. Through that lens, we demonstrate how you can leverage these rules to elevate your CLion built-in static analysis capabilities for your C++ projects.
Read Blog post >
Modernize Code Quality with ‘Quick Fixes’
Boost your productivity by automatically applying fixes to repair code quality issues in your IDE with SonarQube for IDE.
Read Blog post >
Cachet 2.4: Code Execution via Laravel Configuration Injection
We responsibly disclosed three vulnerabilities in the open-source status page Cachet, allowing attackers to take over instances. Here are all the details!
Read Blog post >
Product portals open: we want your input
We've recently opened up product portals on Productboard. You'll find them for SonarQube Server, SonarQube Cloud, and SonarQube for IDE. Each one shows the features we're currently working on, the ones we've released recently, and the ones we're planning.
Read Blog post >