SonarQube connects code-quality and security review to development workflows. Read reports in the context of the selected edition and supported analysis features.
Evaluation approach
Quality gates apply selected criteria to new code. Confirmed security findings and security hotspots requiring review have different meanings, so establish a triage process.
Application example
Turn a reported TLS exception into a tracked remediation task. Do not close the source finding merely because RASP is installed.
Limits and considerations
A green quality gate does not show that all mobile runtime attacks were tested.
What a quality gate establishes
A gate applies the rules and thresholds selected by the team. Passing it does not establish that every mobile security requirement was assessed. Review items and confirmed vulnerabilities may require different workflows.
Rules for new code should not hide existing technical debt. Assign an owner and acceptance criteria to important findings. RASP is not an automatic reason to postpone source fixes.
Checks and decisions
- Verify language coverage
- Justify gate rules
- Assign finding owners
Use SonarQube to support sustained code review rather than making it the sole measure of a security program.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.