Responsible Vulnerability Disclosure

Follow this guide if you’ve found a vulnerability in one of Sonar’s products or websites and you want to responsibly report it.

Sonar customers with a support contract can report the vulnerability directly through the support channel.

Otherwise, send an email to security@sonarsource.com.

What we need from you:

  • Detail the steps you followed that make the vulnerability exploitable including any URLs or code you used. The more information you provide, the faster we can reproduce and fix the problem.
  • Please don’t send PDF, DOC, or EXE files or reports generated by DAST products. We will not look at them. We do accept images.

Focus areas:

  • Cross-site scripting (XSS)
  • SQL injection (SQLi)
  • Cross-site request forgery (CSRF)
  • Remote code execution (RCE)
  • Cookies not used for authentication or CSRF protection, not being marked as Secure or HTTPOnly
  • Data breaches, such as data of private projects or private organizations on SonarQube Cloud.

Out of scope:

Findings that require the attacker to already hold the highest available administrator/owner privileges on their own instance or organization, where the effect is confined to that same instance/organization and results only in the admin gaining functionality gated by a different license tier or edition (e.g., bypassing a per-edition feature limit via timing/race conditions). These are licensing/entitlement issues, not security vulnerabilities, and should be reported to your account team instead.
This exclusion does not apply if the technique can affect another organization, tenant, or user’s data or availability, or if it is achievable by a role below the top-level admin; either of those makes it an access-control issue and keeps it in scope."

How SonarSource rewards you?

It’s in our plans, but we don’t have a bug bounty program currently. Instead, if you accept it, we’ll put you in the Hall of Fame section of this guide under the name or nickname of your choice.

Public disclosure

You need to get our permission before disclosing an issue publicly. We’ll only consider your public disclosure request after we’ve fixed the reported vulnerability.

Hall of Fame

Thank you all for having reported vulnerabilities privately, you rock!

There is some of “well known” url to publish security informations:

security.txt section of https://en.wikipedia.org/wiki/List_of_/.well-known/_services_offered_by_webservers

https://securitytxt.org/ web site helps to implement a security.txt file.

Some examples:
https://www.google.com/.well-known/security.txt
https://n26.com/.well-known/security.txt
https://www.facebook.com/.well-known/security.txt

Too bad it is not widely used…

You are right @farnulfo and this is in our pipe.

@farnulfo: the “security.txt” file is deployed here: https://www.sonarqube.org/.well-known/security.txt

Deployed now on SonarCloud too: https://sonarcloud.io/.well-known/security.txt

It would seem, that both of the links no longer work:

Hi @hilari0n ,

Thank you for reporting the issue. We’ve fixed the sonarqube security.txt and the sonarcloud security.txt will be fixed soon.