# Viewing project security reports

This feature is only available in the [Enterprise plan](https://www.sonarsource.com/plans-and-pricing/#sonarqube-cloud-features).

{% hint style="info" %}
Before you can view the Enterprise-level reports, your organization must be added to an enterprise. For more information, see [managing-enterprise](https://docs.sonarsource.com/sonarqube-cloud/administering-sonarcloud/managing-enterprise "mention").
{% endhint %}

Security reports help you understand where you may have issues related to the following security standards:

* [OWASP Top 10](https://owasp.org/Top10/) (2025, 2021, 2017)

<details>

<summary>OWASP Top 10 security standards covered by Sonar for version 2025</summary>

<table><thead><tr><th width="207.765625">Category</th><th width="87.17962646484375">Python</th><th width="92.93603515625">JS/TS</th><th width="78.802490234375">Java</th><th width="78.2628173828125">C#</th><th width="81.49072265625">C/C++</th><th width="80.1341552734375">PHP</th><th width="86.203125">Kotlin</th><th>Go</th></tr></thead><tbody><tr><td>A01:Broken Access Control</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A02: Security Misconfiguration</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A03: Software Supply Chain Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td><td></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A04: Cryptographic Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A05: Injection</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A06: Insecure design</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A07: Authentication Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A08: Software and Data Integrity Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A09: Logging and Alerting Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td></td></tr><tr><td>A10: Mishandling of Exceptional Conditions</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr></tbody></table>

</details>

* [OWASP Mobile Top 10 2024](https://owasp.org/www-project-mobile-top-10/)

<details>

<summary>OWASP Mobile Top 10 security standards covered by Sonar for version 2024</summary>

<table><thead><tr><th width="206.4246826171875">Standard</th><th>Java</th><th>Kotlin</th><th>Dart</th><th>Swift</th></tr></thead><tbody><tr><td>M1: Improper Credential Usage</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M2: Inadequate Supply Chain Security</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M3: Insecure Authentication/Authorization</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M4: Insufficient Input/Output Validation</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M5: Insecure Communication</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M6: Inadequate Privacy Controls</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M7: Insufficient Binary Protections</td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td><td></td></tr><tr><td>M8: Security Misconfiguration</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M9: Insecure Data Storage</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td></tr><tr><td>M10: Insufficient Cryptography</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr></tbody></table>

</details>

* [CWE Top 25](https://cwe.mitre.org/top25/archive/2024/2024_cwe_top25.html) (2024, 2023, 2022, and 2021)

<details>

<summary>CWE Top 25 security standards covered by Sonar for version 2024</summary>

<table><thead><tr><th width="210.5675048828125">Category</th><th width="83.29473876953125">Python</th><th width="83.7493896484375">JS/TS</th><th width="86.885009765625">Java</th><th width="71.547607421875">C#</th><th width="82.7052001953125">C/C++</th><th width="78.1668701171875">PHP</th><th>Kotlin</th></tr></thead><tbody><tr><td>CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-787 Out-of-bounds Write</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-89 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-352 Cross-Site Request Forgery (CSRF)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td></tr><tr><td>CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-125 Out-of-bounds Read</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-78 Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-416 Use After Free</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-862 Missing Authorization</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-434 Unrestricted Upload of File with Dangerous Type</td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-94 Improper Control of Generation of Code (‘Code Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-20 Improper Input Validation</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-77 Improper Neutralization of Special Elements used in a Command (‘Command Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td></tr><tr><td>CWE-287 Improper Authentication</td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-269 Improper Privilege Management</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-502 Deserialization of Untrusted Data</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-200 Exposure of Sensitive Information to an Unauthorized Actor</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-863 Incorrect Authorization</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-918 Server-Side Request Forgery (SSRF)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-476 NULL Pointer Dereference</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-798 Use of Hard-coded Credentials</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-190 Integer Overflow or Wraparound</td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-400 Uncontrolled Resource Consumption</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-306 Missing Authentication for Critical Function</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr></tbody></table>

</details>

* [CASA](https://appdefensealliance.dev/casa)
* [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) (5.0 and 4.0, levels 1, 2, 3)
* [OWASP MASVS](https://mas.owasp.org/MASVS/)
* [OWASP Top 10 for LLM Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/) (2025)
* [PCI DSS](https://www.pcisecuritystandards.org/) (4.0 and 3.2)
* [STIG ASD](https://www.cyber.mil/stigs/) (6 and 5)

If you have access to [SonarQube Advanced Security](https://github.com/SonarSource/sonarqube-documentation/blob/main/content-output/cloud/default/advanced-security/introduction/README.md), risks from your third-party dependencies will also be included in relevant security reports. If you have access to [SonarQube Advanced Security](https://github.com/SonarSource/sonarqube-documentation/blob/main/content-output/cloud/default/advanced-security/introduction/README.md), risks from your third-party dependencies will also be included in revelant security reports.

## Viewing the security reports of a project branch <a href="#viewing-branch-report" id="viewing-branch-report"></a>

<figure><img src="https://2223713658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB4UT2GNiZKjtxFtcFAL7%2Fuploads%2FhlOm4aPGQGzTSpFW7mtw%2Fproject-security-reports.png?alt=media&#x26;token=e7b5ace9-01ea-4848-ad61-90bb00dbcc08" alt="A number of details are available on the Security reports overview page."><figcaption></figcaption></figure>

1. Retrieve your project. See [retrieving-projects](https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/retrieving-projects "mention") for more details.
2. Go to **Security reports.**
3. Select the **main** branch or other long-lived branch.
4. Select the security standards you want to review. The grid displays the number of raised issues and hotspots by security category.
5. View **Project overall Security rating** and **Project overall Security Review rating** in the **Security reports overview** section.
6. Select the number displayed in the **Security** or **Security Hotspots** columns to review the issues.
7. Select **Download Security report (PDF)** for a PDF version of the report.

## Checking the security rules included in a project’s quality profile <a href="#checking-security-rules" id="checking-security-rules"></a>

<div align="left"><figure><img src="https://2223713658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB4UT2GNiZKjtxFtcFAL7%2Fuploads%2FEDkJsVesQaSjB7fEWSqc%2Fproject-quality-profiles-used.png?alt=media&#x26;token=53c55a91-8308-4823-8922-87339e458755" alt="The four steps described here will help you manage rules that make up your quality profile."><figcaption></figcaption></figure></div>

1. Retrieve your project. See [retrieving-projects](https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/retrieving-projects "mention") for more details.
2. Go to **Project information**.
3. Under **Quality profiles used**, select a quality profile to open it.
4. Once on the **Quality Profiles** page, select the active **Security** rules from the **Software qualities** table’s **Active** column. The **Rules** page will open.
5. In the left-side panel of the **Rules** page, scroll to the **Security Category** and filter the results by specific standards to view the security categories covered by code review and analysis.

<figure><img src="https://2223713658-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FB4UT2GNiZKjtxFtcFAL7%2Fuploads%2FyjR9M3rytiJinry0XYBq%2Frules-security-category.png?alt=media&#x26;token=a83cc823-9ab7-46f3-aa87-171da94539c3" alt="The fourth and final step to manage rules that make up your quality profile."><figcaption></figcaption></figure>

## Downloading a project security PDF report for a branch <a href="#downloading-project-security-report" id="downloading-project-security-report"></a>

As a member of a security or compliance team, you can generate and download project security reports in a PDF format for any given branch.

1. Retrieve your project. See [retrieving-projects](https://docs.sonarsource.com/sonarqube-cloud/managing-your-projects/retrieving-projects "mention") for more details.
2. Go to **Security Reports** and select the **main** branch or another long-lived branch.
3. In the top right corner of the page click **Download Security report (PDF)**.

### Download options <a href="#download-options" id="download-options"></a>

The following download options are available:

* **Default**: Includes Sonar, OWASP top 10 2021 and CWE TOP 25 2024 security standards.
* **Custom**: Choose from a list of all security standards used by SonarQube.

### Contents of the PDF Report <a href="#contents-of-the-pdf-report" id="contents-of-the-pdf-report"></a>

A Security Overview page that includes:

* Project and branch information
* The number of open **Security** issues, **Security Hotspots**, and **Accepted Security issues** on new code and overall code.
* Overall code security ratings for **Security** issues and **Security Hotspots**, including the percentage of reviewed **Security Hotspots**

A report for a given standard that includes:

* A list of categories for **Security** issues and **Security Hotspots**
* Number of issues to address and their relevant rating per category
* Breakdown by severity (Blocker, High, Medium, Low, Info)
* Hotspots that need review

## Related pages <a href="#related-pages" id="related-pages"></a>

* [project-pdf-reports](https://docs.sonarsource.com/sonarqube-cloud/getting-started-with-enterprise/viewing-enterprise-reports/project-pdf-reports "mention")
* [portfolio-security-reports](https://docs.sonarsource.com/sonarqube-cloud/getting-started-with-enterprise/viewing-enterprise-reports/portfolio-security-reports "mention")
* [viewing-project-regulatory-reports](https://docs.sonarsource.com/sonarqube-cloud/getting-started-with-enterprise/viewing-enterprise-reports/viewing-project-regulatory-reports "mention")