Alerting on critical security findings with Security Alerts

In SonarQube Server 2026.5, Security Alerts notify teams when a new high-profile security finding is discovered that security teams need to review.

Security teams use Security Alerts to find and act on critical security findings. Administrators configure which groups receive notifications.

What is a security alert?

Use security alerts to find the most critical issues that may require immediate remediation, such as:

• Public vulnerabilities known to be exploitable
• Malicious software used as a dependency

Security Alerts currently cover Blocker dependency risks discovered by SonarQube Advanced Security, and require Advanced Security as a prerequisite.

Additional alert types will be added in future releases.

How to view current alerts

View security alerts in the top-level Security Alerts menu, available under the "More" section of the menu.

Filter alerts by type (currently only dependency risks) and status. A risk is "Open" if the underlying issue or risk is still present in any branch analyzed by SonarQube. An alert is automatically "Resolved" when the underlying issue or risk is resolved on all branches. Each risk gives details of the risk, and a list of every branch in every project where the risk is present.

Select a risk to view more details on the risk and an expanded summary of how it affects each branch in each project where it is present. Select View risk details to see the risk in the context of the specific branch analysis of the affected project.

Alerts are resolved when the risk is removed, or it is changed to a state such as Safe.

Get notified of newly detected critical findings

Administrators can configure notifications so security teams are alerted when a new critical finding is detected.

To configure notifications:

1. Go to Administration > Security > Groups.
2. Choose the group you would like to receive notifications.
3. Click the Actions menu and choose Manage subscriptions.
4. Add the subscription for "New security alert raised".

Members of that group will be alerted in two ways:

• Immediately via an email when a new critical finding is discovered
• A banner in the SonarQube interface when a critical finding is present