Product: SonarQube Cloud
Project: shopmonkeyus_frontend, main branch, TS/JS
What we see
The “Security snapshot” section on the project dashboard shows:
- Security rating: A
- Security issues: 2
- Security issues by severity: 50% High, 50% Medium
The project has no open security issues. These are the only two security issues on the branch:
typescript:S2819, High. It is marked Accepted.typescript:S2068, Medium. It is marked False Positive.
The API agrees that the count should be 0:
api/measures/component?metricKeys=software_quality_security_issuesreturns0.api/issues/search?impactSoftwareQualities=SECURITY&issueStatuses=OPEN,CONFIRMEDreturnstotal: 0.
What we expect
The widget should match the project measure and the rating, and show 0. If the widget counts closed issues on purpose, it should say so. It could label them, for example “2 (2 accepted or false positive)”, or offer a status filter.
Why it matters
The widget shows 2 security issues next to an A rating, and that looks like a contradiction. Our team spent time looking into findings that had already been reviewed and closed. Other widgets may count issues the same way.
