Does SonarCloud support SCA?

[fai-prive]

Does SonarCloud support SCA or 3rd party library vulnerability scan? I don’t seem to find it, if not. Do you know if there is a plan for that?

[ganncamp (G Ann Campbell)]

Hi,

Welcome to the community!

SonarCloud does not support SCA, and I’m not aware of any current plans.

That said, one option would be to

• run SCA before your SonarCloud analysis
• convert the report to the Generic Issues format
• include the Generic Issues report in your SonarCloud analysis.

But the details of the first two steps are out of scope for us here.

 
HTH,
Ann

[Colin]

Hello from the future!

We recently announced SonarQube Advanced Security, which will include SCA capabilities. While it’s not available yet, we expect general availability for SonarQube Server in May 2025, and SonarQube Cloud Enterprise shortly after.

Please see this announcement for more details.

Announcing SonarQube Advanced Security

Sonar is excited to announce SonarQube Advanced Security, extending SonarQube’s analysis capabilities beyond first-party and AI-generated code to include third-party open source code. With this, we’re delivering the first fully integrated solution for finding and fixing code quality and code security issues in the development phase of the SDLC. The first step in integrating Sonar’s recent acquisition of Tidelift, SonarQube Advanced Security strengthens a robust set of existing security capabili…

[Oodini (Robert)]

If you’re looking for beta-testers, we’re actually trying one of your competitors, and are not very statisfied…