# Following Up On SonarQube Security Vulnerabilities

**URL:** <https://community.sonarsource.com/t/following-up-on-sonarqube-security-vulnerabilities/127108>\
**Category:** SonarQube Server / Community Build\
**Created:** [October 1, 2024, 1:14pm UTC](https://community.sonarsource.com/t/following-up-on-sonarqube-security-vulnerabilities/127108 "2024-10-01T13:14:51Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![can.surmeli](https://avatars.discourse-cdn.com/v4/letter/c/e47774/32.png) [@can.surmeli](https://community.sonarsource.com/u/can.surmeli)\
**Post date:** [October 1, 2024, 1:14pm UTC](https://community.sonarsource.com/t/following-up-on-sonarqube-security-vulnerabilities/127108/1 "2024-10-01T13:14:51Z")

</div>

**Background**

- SonarQube
- Developer Edition
- Dockerized
- v10.6 (92116)

**Want**

I would like to be notified about security vulnerabilities of SonarQube itself. This would include what security fixes an update covers or if available when there is a zero-day attack what are the remedies recommended by SonarSource before a fix is implemented.

**Has Been Done**

I have looked into SonarSource/Qube websites but haven’t come across something. Yes, there is a blog but…

**Preferred**

My preferred method would be communication via email as updates are pushed or vulnerabilities are found.

Is there such a channel? Thanks.

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [October 2, 2024, 2:05pm UTC](https://community.sonarsource.com/t/following-up-on-sonarqube-security-vulnerabilities/127108/2 "2024-10-02T14:05:30Z")

</div>

Hi,

Welcome to the community!

There’s no channel for this. When we discover a vulnerability, we assess and then possibly address it. It will be represented in Jira as a ticket titled something like “Fix SSF-nnn”.

It’s our policy to update such tickets with the vulnerability details 90 days after the versions containing the fixes are released.

&nbsp;  
HTH,  
Ann