Follow this guide if you’ve found a vulnerability in one of Sonar’s products or websites and you want to responsibly report it. Sonar customers with a support contract can report the vulnerability directly through the support channel. Otherwise, send an email to security@sonarsource.com . What we …

There is some of “well known” url to publish security informations: security.txt section of https://en.wikipedia.org/wiki/List_of_/.well-known/_services_offered_by_webservers https://securitytxt.org/ web site helps to implement a security.txt file. Some examples: https://www.google.com/.well-kno…

You are right @farnulfo and this is in our pipe.

@farnulfo : the “security.txt” file is deployed here: https://www.sonarqube.org/.well-known/security.txt

It would seem, that both of the links no longer work: https://sonarcloud.io/.well-known/security.txt https://www.sonarqube.org/.well-known/security.txt

Hi @hilari0n , Thank you for reporting the issue. We’ve fixed the sonarqube security.txt and the sonarcloud security.txt will be fixed soon.

Both security.txt files no longer work. Do you have an indication how fast security findings get handled? I’ve made a report on september 13 and the issue has not yet been triaged.

Responsible Vulnerability Disclosure

Sonar Updates Guides

simon.brandhof (Simon Brandhof) November 18, 2019, 7:35pm 6

Deployed now on SonarCloud too: https://sonarcloud.io/.well-known/security.txt

Topic		Replies	Views
How to report a SonarQube security vulnerability? SonarQube Server / Community Build	1	1152	May 4, 2021
How can i report security bug and a CVE(Common Vulnerabilities and Exposures) for sonarqube application, whats the procedure SonarQube Server / Community Build	1	1372	December 10, 2020
XSS Attack Prevention SonarQube Server / Community Build	5	2345	May 2, 2019
Vulnerability Disclosure Info SonarQube Server / Community Build	1	751	August 20, 2018
Vulnerability in Confluence version SonarQube Server / Community Build documentation	2	789	April 19, 2019

Responsible Vulnerability Disclosure

Related topics