STATIC APPLICATION SECURITY TESTING

Develop secure code with SAST

SAST reduces the risk of security breaches by scanning and analyzing the source code files to identify issues such as security vulnerabilities, bugs, code smells and other flaws to ensure code quality and security.

Start free trial Read the deeper SAST announcement

Clean code with deeper SAST

Sonar’s new deeper SAST capability empowers organizations to identify and resolve application code issues originating from interactions with third-party open-source libraries. This unique feature enables Sonar's SAST to trace data flow in and out of libraries, effectively uncovering deeply concealed security vulnerabilities that other tools fail to detect.

Deeper SAST boosts the existing SAST engine, which already encompasses deep taint analysis, comprehensive security rules, cloud secret detection, and much more. Now, with this innovative technology, commercial editions of SonarQube Server and SonarQube Cloud provide full visibility into the inner workings of the most popular libraries, ensuring unparalleled code analysis.

With Sonar's deeper SAST, organizations can confidently tackle code security challenges, achieve robust application security, and enjoy the benefits of a reliable and fortified codebase.

Try deeper SAST with SonarQube Cloud

CODE SECURITY

Benefits of deeper SAST

Find deeply hidden security issues

Accelerate secure development
Reduce risk of security breaches
Automate code scanning
Code security and compliance
Comprehensive detection engine and coverage

Find deeply hidden security issues

99% of software applications use and interact with the code in third-party libraries (dependencies). Today, most SAST tools only analyze application code and not library code which are mostly a black box for these tools. Deeper SAST from Sonar extends code analysis and scanning to cover the unknown parts of the code that are in the open-source dependencies. Scanning dependencies (libraries) allows Sonar SAST to extend the dataflow analysis and find deeply hidden security issues in code that other tools cannot find. Deeper SAST is available today for Java, C#, and JavaScript/TypeScript in SonarQube Server and SonarQube Cloud. It supports thousands of the topmost and commonly used open-source libraries, including their subsequent (transitive) dependencies. It scales automatically and will be expanded to cover more languages and libraries in the future. Machine Learning (ML) is used for optimization.

Learn more about SAST and SonarQube Server. talk to an expert.

デモをリクエストす

Security analysis

Designed to detect and fix a wide range of code issues that can lead to bugs and security vulnerabilities, Sonar supports over 30 programming languages and frameworks. Sonar's security analysis can help detect a broad range of security issues, such as SQL injection vulnerabilities, cross-site scripting (XSS) code injection attacks, buffer overflows, authentication issues, cloud secrets detection, and much more. In SonarQube Server Enterprise Edition and Data Center Edition and in SonarQube Cloud Enterprise Plan, our security rules are classified according to well-established security standards such as PCI DSS, CWE Top 25, OWASP ASVS, OWASP Top 10, STIG, and CASA.

A table of types of security vulnerabilities Sonar detects and security standards we address.

Security hotspots > code review

Security hotspots are instances of security-sensitive code that require human review. Developers can learn to evaluate security risks and improve their understanding of secure coding practices by working with security hotspots.

Security vulnerabilities > code change/fix

Security vulnerabilities require immediate action. Sonar provides detailed issue descriptions and code highlights that explain why your code is at risk. Just follow the guidance, check in a fix, and secure your application.

Maximum protection with taint analysis

Chase down the bad actors

Making sure user-provided data is sanitized before it hits critical systems (database, file system, OS, etc.) helps ensure your code security. Taint analysis tracks untrusted user input throughout the execution flow - across not just methods but also from file to file.

Explore more features

Critical code security rules for vital languages

Get highly relevant rules for critical languages to help keep your code secure with SAST tooling.

Languages like Java, PHP, C#, C, C++, Python, JavaScript, TypeScript, and more.

Explore all languages

CODE SECURITY

Early security feedback, empowered developers

1/4
Take ownership
2/4
IDE integration
3/4
Quality gate
4/4
Keep It safe

TAKE OWNERSHIP

Real-time feedback

Getting security feedback during code review is your opportunity to learn more and take ownership of Code Security.

With sonar you can assign issues to other developers to help keep your code clean

IDE INTEGRATION

Connected mode with SonarQube for IDE

Find Vulnerabilities and Security Hotspots leveraging Static Application Security Testing (SAST) with SonarQube Server or SonarQube Cloud and fix them in your IDE with SonarQube for IDE as your guide.

QUALITY GATE

Safe code

Enforce Vulnerability standards and Security Hotspot review in your Quality Gate to make sure you only merge safe code.

KEEP IT SAFE

Security rules explained

A deep understanding of the issue and its implications leads to a better fix and a safer application.

An error is found in code and identified while providing an explanation of the risk.

Sonar security reports

Security reports quickly give you the big picture of your code’s compliance with security standards. Available in SonarQube Server Enterprise Edition and Data Center Edition and in SonarQube Cloud Enterprise Plan, these security reports allow you to know where you stand compared to the most common security mistakes. Regulatory reports track the quality of each release and provide evidence that the code delivered meets the quality standards of the organization.

Reports include:

PCI DSS (versions 4.0 and 3.2.1)
OWASP Top 10 (versions 2021 and 2017)
CWE Top 25 (versions 2022, 2021, and 2020)
OWASP ASVS (version 4.0 with level 1 to 3)
STIG
CASA

See OWASP Top 10

Image shows security hotspot vulnerabilities based off of the WASP top 10

Your end-to-end SAST tool

Seamlessly integrate static analysis into your software development workflow

DevOps and CI/CD

Integrating SAST into the DevOps and CI/CD pipelines empowers organizations to enhance the security posture of their software and ensure that vulnerabilities are identified early in the development lifecycle. Security analysis tools become an integral part of the development process and receive early real-time feedback as they commit code changes. Sonar integrations are supported for popular DevOps and CI/CD Platforms including GitHub, GitLab, Azure Devops, TravisCI, CircleCI, and Bitbucket. Sonar provides native support for the most popular SCMs including Git , Subversion and community support for other popular SCMs such as CVS, Jazz RTC, Mercurial, TFVC.

Two developers work together to build new clean code

Pull request decoration

Get instant code review directly inside your pull request and development branches. Fix issues before they become problems.

Implement a Go/No-Go quality gate to automatically fail CI/CD pipelines if code doesn't meet your standards
Review and prioritize code fixes directly within the DevOps Platform interface
Set up multiple quality gates for your monorepo with different projects to receive specific feedback messages for each project

IDE Integration with SonarQube for IDE

Superior code quality tool capabilities right into developers’ code environments
Real-time analytical feedback
Code issue highlighting
Strict code quality standards, along with vulnerability issue details and remediation guidance
Customizable rules allow developers to code based on their specific requirements
Advanced flexibility allows developer adaptation and adoption across multiple supported languages