Built-in quality profiles
SonarQube Cloud ships three built-in quality profiles per language (Sonar way core, extended, and comprehensive), each with a different level of strictness.
SonarQube Cloud provides three built-in quality profiles for each supported language: Sonar way core, Sonar way extended, and Sonar way comprehensive. Each profile applies a different level of strictness. Pick the one that matches your team’s experience with SonarQube and how much friction you want in your workflow.
Sonar way core is the default quality profile for every language in your organization. See Changing default quality profile to change it.
Sonar way core
Sonar way core activates:
All security rules.
Medium and higher severity recommended reliability rules.
Blocker severity recommended maintainability rules.
This profile covers the most impactful rules recommended by Sonar. It helps your team focus on the issues that matter most, and it’s a good baseline for most projects.
Sonar way core also aligns with the following standards: OWASP Top 10, OWASP Mobile Top 10, CWE Top 25, OWASP ASVS, NIST SSDF, PCI DSS, DISA STIG, CASA, the EU Cyber Resilience Act (CRA), the Digital Operational Resilience Act (DORA), GDPR, and SOC 2.
Sonar way extended
Sonar way extended activates:
All security rules.
Low and higher severity recommended reliability rules.
High and higher severity recommended maintainability rules.
This profile builds on Sonar way core, adding more strictness in reliability and maintainability. The rule count still stays balanced, so your team keeps a good development experience. It aligns with the same standards as Sonar way core.
Sonar way comprehensive
Sonar way comprehensive activates:
All security rules.
All recommended reliability rules.
All recommended maintainability rules.
This is Sonar’s comprehensive ruleset. It’s recommended for teams already experienced with SonarQube, or if you’re evaluating SonarQube and want to experience its complete value. It aligns with the same standards as Sonar way core.
Other built-in profiles
Sonar way core, extended, and comprehensive aren’t the only built-in profiles. SonarQube also provides the Sonar agentic AI quality profile for agent centric development, and the Sonar MISRA compliance quality profiles for C and C++ safety-critical code. See Quality profiles for agentic AI and Understanding quality profiles for more information.
Related pages
Last updated
Was this helpful?