Difference in security hotspot detection between EnterpriseEdition and CommunityEdition

SonarQube
,
1

Hello, I have a question.

Is there a difference in the number of issues detected by security hotspotting in the Community Edition compared to the Enterprise Edition?

I know that Enterprise Edition has OWASP / CWE security reporting functionality.
How much of an advantage is the EnterpriseEdition in terms of detecting security hotspots? I don’t know.

Please confirm and answer.

2

Hey there.

Today, there is one Security Hotspot rule that ships with commercial editions of SonarQube (Constructing arguments of system commands from user input is security-sensitive). This rule is available for Java, JavaScript, PHP, Python, C#, and TypeScript.

That doesn’t mean there won’t be more tomorrow.

Enterprise Edition also allows for Security Reports, which breaks down findings into various categories (OWASP, CWE, SANS Top 25…). You can see an example here.

1 Like
3

Thanks for the reply.
I understood it well.

I will also check the URL you provided.
Thank you very much.

4

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.