Using SonarCloud, paid plan. As the reporting in the web app is… sparse… I’ve started investigating what can be seen through the API. I pulled in data from /api/hotspots/search for each project and put this data into Elasticsearch. I can see that there is hotspot data from 2019 through to late 20…

Hi, The first thing to look at is whether your Quality Profiles still contain rules that would raise Security Hotspots. The second thing would be to check whether all your Security Hotspots have been marked Safe & that’s why they don’t show up (by default) in the UI. Ann

They are using the default Quality Profiles for the languages involved. Theres also one default Quality Gate, which can’t be edited or changed. If all of the security hotspots were marked as safe, but new ones were added, that would show up wouldn’t it? Also, most of these projects are listed as …

Hi, That’s a lot of questions. :sweat_smile: We try to keep it to one topic per thread. Otherwise it can get messy, fast. Let’s keep this thread focused on Security Hotspots & can you open a new thread for the Quality Gate question? (Screenshots will help get that one off the ground quickly.) Rega…

Thanks for your help so far, this is fairly sensitive as its a customers paid and private repo and SonarCloud account, so any screen shots I submit here would have to be carefully edited. It would be more helpful if I could find a way to access SonarCloud support directly, but through the SonarClou…

Hi, Paid SonarCloud support is available for an additional charge. Feel free to redact your screenshots as necessary. Ann

We had a developer insert some dummy code which should show as a hotspot, and it did. So it is detecting new hotspots. The problem we have now is that there was no notification or anything that the hotspot had been created. Nothing in ADO, no notifications anywhere, just the hotspot showing in the …

Hi, Take a look at the Security Review rating, or at Security Hotspots to your Quality Gate. HTH, Ann

Hi, I don’t understand how your new thread asks a different question than this. You’re asking how to know there are new Security Hotspots. We don’t send email notifications for that. Security Hotspots are a different type of beast than issues, and we only send emails for issues. So how you find o…

I was asking a different question to the one that I started this topic with and realised that the rules should require a new topic. The default quality gate is being used, which requires hotspots to be 100% reviewed. When we artificially created a hotspot, this was not reported in the comments whi…

Hotspots dried up a year ago, need to confirm if this is because of a problem or if its genuine

SonarQube Cloud

stevedwray (Stephen Wray) November 15, 2023, 2:19am 9

I’m not sure how or whether that answers the question.
Please refer to new thread I created
How do developers know there are new hotspots to review? - SonarCloud - Sonar Community (sonarsource.com)

Topic		Replies	Views
How do developers know there are new hotspots to review? SonarQube Cloud security-hotspot , sonarqube-cloud	0	222	November 13, 2023
Security hotspots not showing on the dashboard SonarQube Cloud sonarqube-cloud	2	603	April 27, 2020
SonarCloud Community: we’ve elevated Security Hotspots to first-class citizen status Announcements security-hotspot	12	3307	June 1, 2021
SonarCloud not showing security hotspots on clicking the tab SonarQube Cloud java , sonarqube-cloud	17	590	March 10, 2023
Measures shows Security Hotspots but the Security Hotspots tab is empty SonarQube Server / Community Build csharp , sonarqube	2	108	February 26, 2025

Hotspots dried up a year ago, need to confirm if this is because of a problem or if its genuine

Related topics