Question about Sonarqube's AI Features AI Code Assurance and AI CodeFix

SonarQube Server / Community Build
1
  • Sonarqube 2025.1.1 LTA deployed via zip.
  • what are you trying to achieve- wanted to understand the AI Features of Sonarqube.

I have a couple of questions regarding the AI features in SonarQube:

  1. Could you please confirm whether the AI features are cloud-based or self-hosted? If they are self-hosted, can you assure that no data is shared externally?

  2. Who will have access to the data ingested and the output generated by the AI? Is this data visible within SonarQube’s UI, and do SonarSource or any third-party applications have access to it?

Thank you for your assistance.

2

Hi,

The docs should get you started. Note that you have the ability to use a self-hosted LLM for the AI CodeFix, and

When you select a self-hosted LLM, your code stays within your network. However, Sonar’s AI CodeFix service needs to send the latest prompts and supported rule descriptions therefore, your instance of SonarQube server will still need internet connectivity.

If you use Sonar’s AI CodeFix LLM, the affected code snippet will be sent by the AI CodeFix service to the selected LLM. Service agreements with Sonar’s LLMs prevent your code from being used to train those models.

 
HTH,
Ann

3

Hi G Ann, am I correct in my understanding about this:

When you select a self-hosted LLM, your code stays within your network. However, Sonar’s AI CodeFix service needs to send the latest prompts and supported rule descriptions therefore, your instance of SonarQube server will still need internet connectivity.

If you use Sonar’s AI CodeFix LLM, the affected code snippet will be sent by the AI CodeFix service to the selected LLM. Service agreements with Sonar’s LLMs prevent your code from being used to train those models.

With a self-hosted LLM, code stays inside your network, but SonarQube still needs internet access for updates (not for sending code). The update is like knowing if there’s a new Sonarqube version?

With Sonar’s AI CodeFix cloud LLM, code snippets are sent to Sonar’s servers, but not used for training or stored long-term.

4

Hi,

In the context of LLMs, it’s not about knowing there’s a new SonarQube version (altho that’s good to know :smiley: ). Again:

To be clear, we get lots of feedback, every day. We’re continually improving things, whether it’s rule descriptions, prompts, or the code itself. So that network connection is to get the best, most up-to-date data to send to your LLM.

Correct.

 
HTH,
Ann