# Security reports

*Security reports are available starting in* [*Enterprise Edition*](https://www.sonarsource.com/plans-and-pricing/enterprise/)*.*

## What do security reports show? <a href="#what-security-reports-show" id="what-security-reports-show"></a>

Security reports quickly give you the big picture of your project, application or portfolio's security. They let you to know where you stand compared to the most common security mistakes made in the past:

* [OWASP Top 10](https://owasp.org/Top10/) (2025, 2021, 2017)

<details>

<summary>OWASP Top 10 security standards covered by Sonar for version 2025</summary>

<table><thead><tr><th width="207.765625">Category</th><th width="87.17962646484375">Python</th><th width="92.93603515625">JS/TS</th><th width="78.802490234375">Java</th><th width="78.2628173828125">C#</th><th width="81.49072265625">C/C++</th><th width="80.1341552734375">PHP</th><th width="86.203125">Kotlin</th><th>Go</th></tr></thead><tbody><tr><td>A01:Broken Access Control</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A02: Security Misconfiguration</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A03: Software Supply Chain Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td><td></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A04: Cryptographic Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A05: Injection</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A06: Insecure design</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A07: Authentication Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A08: Software and Data Integrity Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>A09: Logging and Alerting Failures</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td></td></tr><tr><td>A10: Mishandling of Exceptional Conditions</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr></tbody></table>

</details>

* [OWASP Mobile Top 10 2024](https://owasp.org/www-project-mobile-top-10/)

<details>

<summary>OWASP Mobile Top 10 security standards covered by Sonar for version 2024</summary>

<table><thead><tr><th width="206.4246826171875">Standard</th><th>Java</th><th>Kotlin</th><th>Dart</th><th>Swift</th></tr></thead><tbody><tr><td>M1: Improper Credential Usage</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M2: Inadequate Supply Chain Security</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M3: Insecure Authentication/Authorization</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M4: Insufficient Input/Output Validation</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M5: Insecure Communication</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M6: Inadequate Privacy Controls</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M7: Insufficient Binary Protections</td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td><td></td></tr><tr><td>M8: Security Misconfiguration</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>M9: Insecure Data Storage</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td></td></tr><tr><td>M10: Insufficient Cryptography</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr></tbody></table>

</details>

* [CWE Top 25](https://cwe.mitre.org/top25/archive/2024/2024_cwe_top25.html) (2024, 2023, 2022, and 2021)

<details>

<summary>CWE Top 25 security standards covered by Sonar for version 2024</summary>

<table><thead><tr><th width="210.5675048828125">Category</th><th width="83.29473876953125">Python</th><th width="83.7493896484375">JS/TS</th><th width="86.885009765625">Java</th><th width="71.547607421875">C#</th><th width="82.7052001953125">C/C++</th><th width="78.1668701171875">PHP</th><th>Kotlin</th></tr></thead><tbody><tr><td>CWE-79 Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-787 Out-of-bounds Write</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-89 Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-352 Cross-Site Request Forgery (CSRF)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td></tr><tr><td>CWE-22 Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-125 Out-of-bounds Read</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-78 Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-416 Use After Free</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-862 Missing Authorization</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-434 Unrestricted Upload of File with Dangerous Type</td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-94 Improper Control of Generation of Code (‘Code Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-20 Improper Input Validation</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-77 Improper Neutralization of Special Elements used in a Command (‘Command Injection’)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td></tr><tr><td>CWE-287 Improper Authentication</td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-269 Improper Privilege Management</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-502 Deserialization of Untrusted Data</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-200 Exposure of Sensitive Information to an Unauthorized Actor</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-863 Incorrect Authorization</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr><tr><td>CWE-918 Server-Side Request Forgery (SSRF)</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer</td><td><br></td><td><br></td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-476 NULL Pointer Dereference</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-798 Use of Hard-coded Credentials</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-190 Integer Overflow or Wraparound</td><td><br></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><br></td></tr><tr><td>CWE-400 Uncontrolled Resource Consumption</td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><br></td><td><img src="broken-reference" alt="Checkmark icon"></td><td><img src="broken-reference" alt="Checkmark icon"></td></tr><tr><td>CWE-306 Missing Authentication for Critical Function</td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td><td><br></td></tr></tbody></table>

</details>

* [CASA](https://appdefensealliance.dev/casa)
* [OWASP ASVS](https://owasp.org/www-project-application-security-verification-standard/) (5.0 and 4.0, levels 1, 2, 3)
* [OWASP MASVS](https://mas.owasp.org/MASVS/)
* [OWASP Top 10 for LLM Applications](https://owasp.org/www-project-top-10-for-large-language-model-applications/) (2025)
* [PCI DSS](https://www.pcisecuritystandards.org/) (4.0 and 3.2)
* [STIG ASD](https://www.cyber.mil/stigs/) (6 and 5)

They represent the bare minimum compliance for anyone putting in place a secure development lifecycle.

Depending on the configuration of your SonarQube Server instance, security reports are generated with metrics either from [standard-experience](https://docs.sonarsource.com/sonarqube-server/instance-administration/analysis-functions/instance-mode/standard-experience "mention") or [mqr-mode](https://docs.sonarsource.com/sonarqube-server/instance-administration/analysis-functions/instance-mode/mqr-mode "mention").

### Software Composition Analysis (SCA) in security reports

If you have [SonarQube Advanced Security](https://www.sonarsource.com/solutions/security/), the reports include Software Composition Analysis (SCA) data in a **Dependency Risk** column for project, application and portfolio-level reports in both the SonarQube Server UI and exported PDFs. See [advanced-security](https://docs.sonarsource.com/sonarqube-server/advanced-security "mention") for more details.

## What are the differences among the security issues? <a href="#the-difference-between-a-security-hotspot-and-a-vulnerability" id="the-difference-between-a-security-hotspot-and-a-vulnerability"></a>

Security Hotspots and Security Vulnerabilities (in Standard Experience) or Security issues (in MQR Mode) differ in that:

* Security Hotspot is a security-sensitive piece of code that is highlighted but doesn’t necessarily impact the overall application security. It’s up to the developer to review the code and determine whether or not a fix is needed to secure it.
* Security Vulnerability (in Standard Experience) or Security (in MQR Mode) is a problem that impacts the application’s security and needs to be fixed immediately.

For more details, see the [security-hotspots](https://docs.sonarsource.com/sonarqube-server/user-guide/security-hotspots "mention") page.

## Why don’t I see any security issues? <a href="#i-do-not-see-vulnerabilities-or-security-hotspots" id="i-do-not-see-vulnerabilities-or-security-hotspots"></a>

A rating is unavailable and displayed as a dash (-) for Security Vulnerabilities (in Standard Experience), Security issues (in MQR Mode), or Security Hotspots for the following reasons:

* Your code has been written without using any security-sensitive API.
* Security Vulnerability (in Standard Experience), Security (in MQR Mode), or Security Hotspot rules are available but not activated in your quality profile, so no security issues are being raised. For example. if there are no rules corresponding to a given OWASP category activated in your quality profile, you won’t get issues linked to that specific category and the rating displayed will be a dash (-).
* SonarQube Server might not currently have many rules for your programming language, so it won’t raise any issues or only a few security issues are being recognized.

## Downloading a PDF copy <a href="#download-a-pdf-copy" id="download-a-pdf-copy"></a>

You can download a PDF copy of your security report for projects and applications:

<figure><img src="https://2744305742-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3VWSqvZ4eaBLWvA6epdv%2Fuploads%2FLSuwJA1IudVwLlrlwu7e%2Fproject-security-report.png?alt=media&#x26;token=b6d4a32e-9eca-4c8d-997b-eada41515988" alt="Downloading a PDF copy of your security report"><figcaption></figcaption></figure>

1. Retrieve your project or application. See [retrieving-projects](https://docs.sonarsource.com/sonarqube-server/user-guide/viewing-projects/retrieving-projects "mention") for more information.
2. Go to **Security reports** and select **Download security report (PDF)**.

The PDF contains:

* The number of open Security Vulnerabilities (in Standard Experience) or Security issues (in MQR Mode) and the security rating on both overall code and new code.
* The number of Security Hotspots, the percentage of reviewed Security Hotspots, and the security review rating on both overall and new code.
* Your Sonar, OWASP, CWE reports.

## Related pages <a href="#related-pages" id="related-pages"></a>

* [pdf-reports](https://docs.sonarsource.com/sonarqube-server/user-guide/viewing-reports/pdf-reports "mention")
* [regulatory-reports](https://docs.sonarsource.com/sonarqube-server/user-guide/viewing-reports/regulatory-reports "mention")
* [portfolios](https://docs.sonarsource.com/sonarqube-server/user-guide/viewing-reports/portfolios "mention")
* [#downloading-a-dependency-risk-report](https://docs.sonarsource.com/sonarqube-server/advanced-security/reviewing-and-fixing-dependency-risks#downloading-a-dependency-risk-report "mention")