Follow this guide if you’ve found a vulnerability in one of Sonar’s products or websites and you want to responsibly report it. Sonar customers with a support contract can report the vulnerability directly through the support channel. Otherwise, send an email to security@sonarsource.com . What we …

There is some of “well known” url to publish security informations: security.txt section of https://en.wikipedia.org/wiki/List_of_/.well-known/_services_offered_by_webservers https://securitytxt.org/ web site helps to implement a security.txt file. Some examples: https://www.google.com/.well-kno…

You are right @farnulfo and this is in our pipe.

@farnulfo : the “security.txt” file is deployed here: https://www.sonarqube.org/.well-known/security.txt

Deployed now on SonarCloud too: https://sonarcloud.io/.well-known/security.txt

It would seem, that both of the links no longer work: https://sonarcloud.io/.well-known/security.txt https://www.sonarqube.org/.well-known/security.txt

Responsible Vulnerability Disclosure

Sonar Updates Guides

Joe (Joe) May 24, 2024, 4:46pm 15

Hi @hilari0n ,

Thank you for reporting the issue. We’ve fixed the sonarqube security.txt and the sonarcloud security.txt will be fixed soon.

Topic		Replies	Views
How to report a SonarQube security vulnerability? SonarQube Server / Community Build	2	1120	May 4, 2021
How can i report security bug and a CVE(Common Vulnerabilities and Exposures) for sonarqube application, whats the procedure SonarQube Server / Community Build	1	1341	December 10, 2020
Vulnerability Disclosure Info SonarQube Server / Community Build	1	717	August 20, 2018
XSS Attack Prevention SonarQube Server / Community Build	5	2314	May 2, 2019
Vulnerability in Confluence version SonarQube Server / Community Build documentation	2	772	April 19, 2019

Responsible Vulnerability Disclosure

Related topics