I know that HCL DX will save HTML, JavaScript, and similar code as text. Something that would be easy for SonarQube to review for vulnerabilities. But I’m wondering about script application code, which as I understand it is specific to DX. (I have very limited experience with DX.) It is my understanding that the developer has to go through the additional steps of exporting those objects as text. I get the impression that if someone doesn’t export it, then it will be in some binary format, which Git and I’m sure SonarQube cannot process looking for vulnerabilities.
Getting back to that exported text, can SonarQube read and process that looking for vulnerabilities?