I’ve observed some inconsistencies in my security issue findings in SonarQube Cloud. First of all, the number of security hotspots decreased and the number of security issues increased. Additionally, I noticed that the same rule is being surfaced differently in different langauges.
For example, for the rule ID SS2245, I noticed that in C# it is showing up under Security Issue and for Javascript it is showing up under Security Hotspot. I queried the Rule API for the rule defintions and I saw the following for both rules:
However, in the UI they are showing under different categories. I would like to understand why this is happening and if there’s anything I can do in my project to make everything surface consistently? Also, are there any other reasons why the security issues would have jumped up suddenly despite us actively using SonarQube and remediating issues that I should look into?
As outlined in this comment in the thread that you found, we are currently at a point in time where:
No new hotspots are raised, instead they are raised as security issues.
Old hotspots haven’t been yet migrated (the exact time at which this will happen isn’t clear yet, but it’s expected later in Q3).
I suspect in your case, the issue on the Javascript code is pre-existing (it was created back when hotspots were still being raised) but the issue on the C# code is new (it was created after we stopped raising hotspots and started raising security issues instead). Could you check the exact creation date of the issues (go to the issue > Activity tab)?
According to the activity tab, the C# issues were raised on Aug 21, 2026, which was when our last scan was done. I also noticed that there’s two points of activity here, one where the issue was set to fixed and one where it was reopened.
Okay, the C# issue is clear: by August 21st, no new hotspots were being raised. The Javascript issue is a bit more on the edge: I’m not sure if by June 22nd this rule was raising hotspots or security issues. The fact that it raised it a hotspot for you really makes me think it hadn’t been changed yet, but I’ll flag it for the devs to have a look.
I understand that you have another question though: you mentioned you have seen the number of hotspots decrase and the number of security issues increase. My understanding is that the migration will be a one-time action, not gradual, but again, I’ll flag this so that the devs can confirm.
I would assume that this trend you’ve seen is related with the fact that, as new code is added, no more hotspots are raised, and the existing ones might be fixed by your devs, while new security issues are raised at a higher rate than earlier. Do you have any reason to believe this is not the case? Like for example, are there any issues for which you don’t understand why were they raised?
Just wanted to remark: soon, existing hotspots will be converted to security issues, so anyway, the discrepancy and the trends you perceive will disappear.
