# Can Sonarcloud help prevent black listed packages being used in projects?

**URL:** <https://community.sonarsource.com/t/can-sonarcloud-help-prevent-black-listed-packages-being-used-in-projects/99128>\
**Category:** SonarQube Cloud\
**Tags:** sonarqube-cloud\
**Created:** [September 12, 2023, 3:51pm UTC](https://community.sonarsource.com/t/can-sonarcloud-help-prevent-black-listed-packages-being-used-in-projects/99128 "2023-09-12T15:51:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![JamesCroweBoden](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/jamescroweboden/32/49145_2.png) [@JamesCroweBoden](https://community.sonarsource.com/u/JamesCroweBoden)\
**Post date:** [September 12, 2023, 3:51pm UTC](https://community.sonarsource.com/t/can-sonarcloud-help-prevent-black-listed-packages-being-used-in-projects/99128/1 "2023-09-12T15:51:26Z")

</div>

Hi, we have a couple of nuget packages which we explicitly do not want engineers to use. Is there any way SonarCloud can be configured to flag and fail the quality gate, when a certain package is referenced in a project?

If not, could the community recommend alternative ways to achieve this?

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [September 13, 2023, 9:46am UTC](https://community.sonarsource.com/t/can-sonarcloud-help-prevent-black-listed-packages-being-used-in-projects/99128/2 "2023-09-13T09:46:52Z")

</div>

Hey there.

Giving the Sonar(Source) perspective – SonarCloud does not perform SCA (Software Component Analysis) – and there is no rule to prevent the use of certain Nuget packages. Tools dedicated to SCA may be able to provide you with this functionality!

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [March 18, 2025, 2:40pm UTC](https://community.sonarsource.com/t/can-sonarcloud-help-prevent-black-listed-packages-being-used-in-projects/99128/3 "2025-03-18T14:40:07Z")

</div>

Hello from the future!

We recently announced SonarQube Advanced Security, which will include SCA capabilities. While it’s not available yet, we expect general availability for SonarQube Server in May 2025, and SonarQube Cloud Enterprise shortly after.

Please see this announcement for more details.

> [@Announcing SonarQube Advanced Security](https://community.sonarsource.com/t/announcing-sonarqube-advanced-security/136625):
>
> Sonar is excited to [announce SonarQube Advanced Security](https://www.sonarsource.com/company/press-releases/sonar-extends-code-security-coverage-with-sonarqube-advanced-security/), extending SonarQube’s analysis capabilities beyond first-party and AI-generated code to include third-party open source code. With this, we’re delivering the first fully integrated solution for finding and fixing code quality and code security issues in the development phase of the SDLC. The first step in integrating Sonar’s recent acquisition of Tidelift, SonarQube Advanced Security strengthens a robust set of existing security capabili…