Ctrlk
Start Free
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Built-in quality profiles

SonarQube Server 2026.5 ships three built-in quality profiles per language (Sonar way core, extended, and comprehensive), each with a different level of strictness.

SonarQube Server provides three built-in quality profiles for each supported language: Sonar way core, Sonar way extended, and Sonar way comprehensive. Each profile applies a different level of strictness. Pick the one that matches your team’s experience with SonarQube and how much friction you want in your workflow.

Sonar way core is the default quality profile for every language. See Changing default quality profile to change it.

Sonar way core

Sonar way core activates:

  • All security rules (vulnerabilities in Standard Experience).

  • Medium and higher severity recommended reliability rules (Major and higher severity bugs in Standard Experience).

  • Blocker severity recommended maintainability rules (Blocker severity code smells in Standard Experience).

This profile covers the most impactful rules recommended by Sonar. It helps your team focus on the issues that matter most, and it’s a good baseline for most projects.

Sonar way core also aligns with the following standards: OWASP Top 10, OWASP Mobile Top 10, CWE Top 25, OWASP ASVS, NIST SSDF, PCI DSS, DISA STIG, CASA, the EU Cyber Resilience Act (CRA), the Digital Operational Resilience Act (DORA), GDPR, and SOC 2.

Sonar way extended

Sonar way extended activates:

  • All security rules (vulnerabilities in Standard Experience).

  • Low and higher severity recommended reliability rules (Minor and higher severity bugs in Standard Experience).

  • High and higher severity recommended maintainability rules (Critical and higher severity code smells in Standard Experience).

This profile builds on Sonar way core, adding more strictness in reliability and maintainability. The rule count still stays balanced, so your team keeps a good development experience. It aligns with the same standards as Sonar way core.

Sonar way comprehensive

Sonar way comprehensive activates:

  • All security rules (vulnerabilities in Standard Experience).

  • All recommended reliability rules (bugs in Standard Experience).

  • All recommended maintainability rules (code smells in Standard Experience).

This is Sonar’s comprehensive ruleset. It’s recommended for teams already experienced with SonarQube, or if you’re evaluating SonarQube and want to experience its complete value. It aligns with the same standards as Sonar way core.

Sonar way comprehensive replaces the quality profile formerly named Sonar way.

When you update to SonarQube Server 2026.5 from an earlier version, your projects keep the quality profiles they used in the previous version. The default profile of each language also stays the same.

Other built-in profiles

Sonar way core, extended, and comprehensive aren’t the only built-in profiles. SonarQube also provides the Sonar agentic AI quality profile for agent centric development, and the Sonar MISRA compliance quality profiles for C and C++ safety-critical code. See Quality profiles for agentic AI and Understanding quality profiles for more information.

Related pages

PreviousIntroduction
NextUnderstanding quality profiles

Last updated

Was this helpful?