# Security-related rules

The four rule types included in the SonarQube quality model are:

* Reliability (bug)
* Maintainability (code smell)
* Security (vulnerability)
* Security Hotspot

Security-related rules include Security rules and Security Hotspot rules. They are divided into two types: security-injection and security-configuration rules.

{% hint style="info" %}
Security is a lively world where new types of attacks and vulnerabilities appear very often, so we welcome any suggestions for new security rules. You can read the [adding-coding-rules](https://docs.sonarsource.com/sonarqube-server/extension-guide/adding-coding-rules "mention") page to see how to develop a new rule or propose a new one on our [Community forum](https://community.sonarsource.com/c/suggestions/rules/13).
{% endhint %}

## Security-injection rules <a href="#security-injection-rules" id="security-injection-rules"></a>

Security-injection rules are used to detect injection vulnerabilities. An injection vulnerability (also known as injection flaw or taint vulnerability) occurs when the inputs handled by your application are controlled by a user (potentially an attacker) and not validated or sanitized. When this occurs, the flow from sources (user-controlled inputs) to sinks (sensitive functions) will be presented. Common types include SQL Injection, Deserialization, and Command Injection vulnerabilities.

To show the flow of tainted issues, SonarQube Server uses well-known taint analysis technology on source code which allows, for example, the detection of:

* [CWE-89](https://cwe.mitre.org/data/definitions/89.html): SQL Injection
* [CWE-79](https://cwe.mitre.org/data/definitions/79.html): Cross-site Scripting
* [CWE-94](https://cwe.mitre.org/data/definitions/94.html): Code Injection

{% hint style="info" %}

* Security-injection rules are supported only by SonarQube Server and Cloud. SonarQube for IDE pulls the injection vulnerabilities raised by these products during a project analysis.
* With SonarQube Server’s Security engine custom configuration, it’s possible to extend the taint analysis of security-injection rules by configuring new sources, sanitizers, validators and sinks within the homemade frameworks that you use.
  {% endhint %}

## Security-configuration rules <a href="#security-configuration-rules" id="security-configuration-rules"></a>

The security-configuration rules are used to raise a security issue when:

* A sensitive function is called with a wrong parameter (invalid cryptographic algorithm or TLS version).
* A check (for example, a check\_permissions() kind of function) is not done or is not in the correct order.\
  This problem is likely to appear often when the program is executed.

Examples:

* [CWE-1004](https://cwe.mitre.org/data/definitions/1004.html): Sensitive Cookie Without ‘HttpOnly’ Flag
* [CWE-297](https://cwe.mitre.org/data/definitions/297.html): Improper Validation of Certificate with Host Mismatch
* [CWE-327](https://cwe.mitre.org/data/definitions/327.html): Use of a Broken or Risky Cryptographic Algorithm

## Differences between security issues (vulnerabilities) and hotspots <a href="#vulnerabilities-and-hotspots" id="vulnerabilities-and-hotspots"></a>

Security hotspots have been introduced for security protections that have no direct impact on the overall application’s security. With hotspots, we want to help developers understand information security risks, threats, impacts, root causes of security issues, and the choice of relevant software protections. In short, we really want to educate developers and help them develop secure, ethical, and privacy-friendly applications.

For more information about hotspots and vulnerabilities, see the [security-hotspots](https://docs.sonarsource.com/sonarqube-server/user-guide/security-hotspots "mention") page.

## Security standards covered <a href="#security-standards-covered" id="security-standards-covered"></a>

Our security rules are classified according to well-established security standards such as:

* [OWASP Top 10](https://owasp.org/Top10/) (2025, 2021, 2017)

<details>

<summary>OWASP Top 10 security standards covered by Sonar for version 2025</summary>

<table><thead><tr><th width="207.765625">Category</th><th width="87.17962646484375">Python</th><th width="92.93603515625">JS/TS</th><th width="78.802490234375">Java</th><th width="78.2628173828125">C#</th><th width="81.49072265625">C/C++</th><th width="80.1341552734375">PHP</th><th width="86.203125">Kotlin</th><th>Go</th></tr></thead><tbody><tr><td>A01:Broken Access Control</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A02: Security Misconfiguration</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A03: Software Supply Chain Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td><td></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A04: Cryptographic Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A05: Injection</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A06: Insecure design</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A07: Authentication Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A08: Software and Data Integrity Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A09: Logging and Alerting Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td></td></tr><tr><td>A10: Mishandling of Exceptional Conditions</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr></tbody></table>

</details>

* [OWASP Mobile Top 10 2024](https://owasp.org/www-project-mobile-top-10/)

<details>

<summary>OWASP Mobile Top 10 security standards covered by Sonar for version 2024</summary>

<table><thead><tr><th width="206.4246826171875">Standard</th><th>Java</th><th>Kotlin</th><th>Dart</th><th>Swift</th></tr></thead><tbody><tr><td>M1: Improper Credential Usage</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M2: Inadequate Supply Chain Security</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M3: Insecure Authentication/Authorization</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M4: Insufficient Input/Output Validation</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M5: Insecure Communication</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M6: Inadequate Privacy Controls</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M7: Insufficient Binary Protections</td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td><td></td></tr><tr><td>M8: Security Misconfiguration</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M9: Insecure Data Storage</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td></tr><tr><td>M10: Insufficient Cryptography</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr></tbody></table>

</details>

* [CWE Top 25](https://cwe.mitre.org/top25/archive/2024/2024_cwe_top25.html) (2024, 2023, 2022, and 2021)

<details>

<summary>CWE Top 25 security standards covered by Sonar for version 2024</summary>

<table><thead><tr><th width="210.5675048828125">Category</th><th width="83.29473876953125">Python</th><th width="83.7493896484375">JS/TS</th><th width="86.885009765625">Java</th><th width="71.547607421875">C#</th><th width="82.7052001953125">C/C++</th><th width="78.1668701171875">PHP</th><th>Kotlin</th></tr></thead><tbody><tr><td>CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-787 Out-of-bounds Write</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-89 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-352 Cross-Site Request Forgery (CSRF)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td></tr><tr><td>CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-125 Out-of-bounds Read</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-78 Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-416 Use After Free</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-862 Missing Authorization</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-434 Unrestricted Upload of File with Dangerous Type</td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-94 Improper Control of Generation of Code (‘Code Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-20 Improper Input Validation</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-77 Improper Neutralization of Special Elements used in a Command (‘Command Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td></tr><tr><td>CWE-287 Improper Authentication</td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-269 Improper Privilege Management</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-502 Deserialization of Untrusted Data</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-200 Exposure of Sensitive Information to an Unauthorized Actor</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-863 Incorrect Authorization</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-918 Server-Side Request Forgery (SSRF)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-476 NULL Pointer Dereference</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-798 Use of Hard-coded Credentials</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-190 Integer Overflow or Wraparound</td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-400 Uncontrolled Resource Consumption</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-306 Missing Authentication for Critical Function</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr></tbody></table>

</details>

* [CASA](https://appdefensealliance.dev/casa)
* [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) (5.0 and 4.0, levels 1, 2, 3)
* [OWASP MASVS](https://mas.owasp.org/MASVS/)
* [OWASP Top 10 for LLM Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/) (2025)
* [PCI DSS](https://www.pcisecuritystandards.org/) (4.0 and 3.2)
* [STIG ASD](https://www.cyber.mil/stigs/) (6 and 5)