Portfolio Security Vulnerabilities Activity Custom Graph shows a Security Rating of A even though there is one critical vulnerability. An A Rating is supposed to be for 0 vulnerabilities. This is for Overall code.
Hi,
Welcome to the community and thanks for this report!
What’s your SonarQube version?
Ann
Hi Ann,
It’s version 9.8 Enterprise Edition.
Hi,
Could you upgrade to 9.9 - the latest version and current LTS - and see if this is replicable, please?
Thx,
Ann
Hello,
I believe that at Portfolio level there is no problem in what you are describing. The Portfolio Ratings use averages and don’t take the worst rating of underlying projects. The idea of Portfolios is to share the big picture. In your case, you are globally good, this is why you have a A Rating. Still, you are at risk on one project that is highlighted in the Risk section.
If we were applying the same logic than at Project level, there is a great chance that your Portfolios will always be red with E Rating.
Alex
1 Like
