Hello,
We have a question regarding Security Hotspots handling in Quality Gates for new code.
At the moment, we are using the Security Hotspots Reviewed metric in the Quality Gate. However, we noticed that SonarQube considers a hotspot as reviewed when it is marked as Acknowledged, Fixed, or Safe.
In our case, we want to keep track of Acknowledged hotspots separately, because these are hotspots that were reviewed and confirmed as risky, and we want them to be resolved before the PR is merged.
Is there any way to:
-
Add a metric or custom condition in the Quality Gate that specifically tracks Acknowledged Security Hotspots on new code, and
-
Fail the Quality Gate until those acknowledged hotspots are fixed?
If this is not currently supported, is there any recommended workaround to enforce this behavior? and can we want to request this feature if possible.
Thanks for your support.
Regards,
Eman