Deeper SAST Functionality - Hints and Tips

SonarQube Server / Community Build
1

Hi, first time creating a topic, so please be gentle.

I’m conducting a PoC to investigate the SQ server Deeper SAST functionality. We’ve created a SQ instance with temp license and moved some projects within it. All seems to be working well, but the deeper SAST scanning doesn’t seem to be working for us. There is no 1+1 = 3 type of issue where functionality of some of our code, calling on a library, leads to a deeper issue.
I’ve watched the videos and read the documentation, but what am I actually supposed to ‘See’?

2

Hey there.

It’s not obvious in SonarQube when a vulnerability has been identified as the result of Deeper SAST. However, you may find this demo repo we use interesting: GitHub - Sonar-Demos/deeper-sast-demo