# How to report a SonarQube security vulnerability?

**URL:** <https://community.sonarsource.com/t/how-to-report-a-sonarqube-security-vulnerability/42743>\
**Category:** SonarQube Server / Community Build\
**Created:** [May 4, 2021, 5:15pm UTC](https://community.sonarsource.com/t/how-to-report-a-sonarqube-security-vulnerability/42743 "2021-05-04T17:15:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ruckc](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ruckc/32/21873_2.png) [@ruckc](https://community.sonarsource.com/u/ruckc)\
**Post date:** [May 4, 2021, 5:15pm UTC](https://community.sonarsource.com/t/how-to-report-a-sonarqube-security-vulnerability/42743/1 "2021-05-04T17:15:59Z")

</div>

I found a security vulnerability in the latest version of SonarQube. What is the process for reporting it, so it can be fixed prior to public disclosure.

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [May 4, 2021, 5:42pm UTC](https://community.sonarsource.com/t/how-to-report-a-sonarqube-security-vulnerability/42743/2 "2021-05-04T17:42:03Z")

</div>

Hi,

Welcome to the community & thanks for asking!

I think this is what you’re looking for:

> [@Responsible Vulnerability Disclosure](https://community.sonarsource.com/t/responsible-vulnerability-disclosure/9317):
>
> Follow this guide if you’ve found a vulnerability in one of Sonar’s products or websites and you want to responsibly report it. Sonar customers with a support contract can report the vulnerability directly through the support channel. Otherwise, send an email to [security@sonarsource.com](mailto:security@sonarsource.com). What we need from you: Detail the steps you followed that make the vulnerability exploitable including any URLs or code you used. The more information you provide, the faster we can reproduce and fix the pr…

&nbsp;  
Ann

---

<div class="post-metadata">

**Author:** ![system](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/system/32/31083_2.png) [@system](https://community.sonarsource.com/u/system)\
**Post date:** [May 11, 2021, 5:42pm UTC](https://community.sonarsource.com/t/how-to-report-a-sonarqube-security-vulnerability/42743/3 "2021-05-11T17:42:59Z")

</div>

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.