Hello,
I’ve observed some inconsistencies in my security issue findings in SonarQube Cloud. First of all, the number of security hotspots decreased and the number of security issues increased. Additionally, I noticed that the same rule is being surfaced differently in different langauges.
For example, for the rule ID SS2245, I noticed that in C# it is showing up under Security Issue and for Javascript it is showing up under Security Hotspot. I queried the Rule API for the rule defintions and I saw the following for both rules:
“type”: “VULNERABILITY”,
“sysTags”: [“former-hotspot”]
This indicates to me that the rules were migrated from hotspots to issues, as per this post here: Moving Security Hotspots to Security Issues
However, in the UI they are showing under different categories. I would like to understand why this is happening and if there’s anything I can do in my project to make everything surface consistently? Also, are there any other reasons why the security issues would have jumped up suddenly despite us actively using SonarQube and remediating issues that I should look into?