# Open Source Vulnerability Scanner in SonarQube?

**URL:** <https://community.sonarsource.com/t/open-source-vulnerability-scanner-in-sonarqube/29373>\
**Category:** Suggest new features\
**Tags:** sonarqube, scanner\
**Created:** [August 11, 2020, 7:53am UTC](https://community.sonarsource.com/t/open-source-vulnerability-scanner-in-sonarqube/29373 "2020-08-11T07:53:48Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![dmankarbmc](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dmankarbmc](https://community.sonarsource.com/u/dmankarbmc)\
**Post date:** [August 11, 2020, 7:53am UTC](https://community.sonarsource.com/t/open-source-vulnerability-scanner-in-sonarqube/29373/1 "2020-08-11T07:53:48Z")

</div>

Hi Team,

I’m evaluating SonarQube and I’ve not been able to find the Open Source Vulnerability scanner in SonarQube Developer edition.  
I’m looking for a feature similar to [Nexus OSA Scanner](https://www.sonatype.com/appscan) or [Snyk](https://snyk.io/) So that I don’t have to use different tools for different features.

Is there anything I’m missing or it is available in some other edition? Please let us know.

Best Regards,  
Devesh

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [August 11, 2020, 7:55am UTC](https://community.sonarsource.com/t/open-source-vulnerability-scanner-in-sonarqube/29373/2 "2020-08-11T07:55:38Z")

</div>

Hey there.

For the most part, we really leave any sort of SCA (Software Component Analysis) to those who do it best (like our friends at [Snyk](https://snyk.io/) or [WhiteSource](https://www.whitesourcesoftware.com/)), while our focus in static analysis.

If you _really_ wanted to get these results in SonarCloud somehow, you could try converting the reports to [Generic Issue Data](https://sonarcloud.io/documentation/analysis/generic-issue/).

---

<div class="post-metadata">

**Author:** ![dmankarbmc](https://avatars.discourse-cdn.com/v4/letter/d/8baadc/32.png) [@dmankarbmc](https://community.sonarsource.com/u/dmankarbmc)\
**Post date:** [August 11, 2020, 8:39am UTC](https://community.sonarsource.com/t/open-source-vulnerability-scanner-in-sonarqube/29373/3 "2020-08-11T08:39:18Z")

</div>

Ok, Thanks for the quick reply. That helps !

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [March 18, 2025, 2:36pm UTC](https://community.sonarsource.com/t/open-source-vulnerability-scanner-in-sonarqube/29373/4 "2025-03-18T14:36:25Z")

</div>

Hello from the future!

We recently announced SonarQube Advanced Security, which will include SCA capabilities. While it’s not available yet, we expect general availability for SonarQube Server in May 2025, and SonarQube Cloud Enterprise shortly after.

Please see this announcement for more details.

> [@Announcing SonarQube Advanced Security](https://community.sonarsource.com/t/announcing-sonarqube-advanced-security/136625):
>
> Sonar is excited to [announce SonarQube Advanced Security](https://www.sonarsource.com/company/press-releases/sonar-extends-code-security-coverage-with-sonarqube-advanced-security/), extending SonarQube’s analysis capabilities beyond first-party and AI-generated code to include third-party open source code. With this, we’re delivering the first fully integrated solution for finding and fixing code quality and code security issues in the development phase of the SDLC. The first step in integrating Sonar’s recent acquisition of Tidelift, SonarQube Advanced Security strengthens a robust set of existing security capabili…