Introduction
SonarQube Advanced Security is an Enterprise product that extends SonarQube’s capabilities with deeper security analysis and compliance-focused features. This page is for SonarQube Server 2026.4.
Advanced Security is available in SonarQube Server as a paid product starting in Enterprise edition.
Overview
SonarQube Advanced Security is an Enterprise product that extends SonarQube’s capabilities by offering deeper security analysis and compliance-focused features such as Software Composition Analysis (SCA) and advanced SAST.
Designed for organizations that require enterprise-grade application security, it helps developers detect vulnerabilities and risks in open source code early in the software development lifecycle.
Software Composition Analysis (SCA)
SonarQube Server can identify your open source dependencies and discover issues with them, ensuring security and compliance.
Vulnerability identification: Track, manage, and mitigate vulnerabilities in publicly available third-party dependencies, such as vulnerabilities tracked by the CVE (Common Vulnerabilities and Exposures) project.
Malicious package discovery: Protect against malware compromise by checking your dependencies against known malicious packages.
License management: Ensure projects follow your organization’s policies for allowed software licenses.
Software Bills of Materials (SBOM): Export an inventory that helps understand, manage, and report on your dependency usage.
Supported platforms
Dependency analysis is currently available for the following languages:
JavaScript/TypeScript (npm, yarn, pnpm, bun)
Java, Kotlin, Scala (Maven, Gradle)
Python (pip, poetry, pipenv)
C# / .NET (nuget)
Go
Ruby (bundler)
Rust (Cargo)
PHP
Data sources
Sonar uses the following sources of vulnerability data:
OSV, including OpenSSF Malicious Packages
The Sonar service accesses these sites regularly to get the latest updates, and supplements that data with manual research as well as insights from open source maintainers. All data sources are checked, at minimum, hourly.
Sonar uses license data from upstream package managers and source repositories, and supplements it with manual research.
Advanced SAST
SonarQube Server is a Static Application Security Testing (SAST) tool. It examines your project's source code, without executing it, allowing you to find vulnerabilities before they enter your codebase.
The categories of issue types detected through SAST include SQL injection, cross-site scripting, deserialization, secret detection, and more.
Advanced SAST extends code analysis and scanning to cover the unknown parts of the code that are in the open-source dependencies. It helps you identify deeper and more complex vulnerabilities due to the interaction of your application code with third-party (open-source) code.
Advanced SAST is available for the following languages:
JavaScript/TypeScript
Java
C# / .NET
Related pages
Related online learning
Last updated
Was this helpful?