Known C# vulnerabilities not detected by SonarQube

[danb.sn]

My dotNetCore c# project include nugget package dependency BouncyCastle.Cryptography ver. 2.1.1
According to Visual Studio it is vulnerable and has 3 known issues.
Sonar did not detect them

[ganncamp (G Ann Campbell)]

Hi,

Are the vulnerabilities in your code or in the dependency? We don’t do SCA.

 
Ann

[danb.sn]

Thanks for your answer.
Where can I find details of how SonarQube Server verify that the code is secured ?

[ganncamp (G Ann Campbell)]

Hi,

With static analysis, including - in paid offerings - taint analysis. This blog may help.

 
Ann