Secret Detection vs LOC

Hi,

I’d like to clarify how sonar.text.inclusions interacts with LOC-based billing.

As I understand it:

  • sonar.text.inclusions adds files to the secrets-detection engine’s scope, separately from sonar.inclusions/sonar.exclusions, which controls the main analysis pipeline.
  • The “Lines of Code” documentation states that LOC is calculated by excluding “files excluded from analysis” and “code in unsupported languages.”

My question: for files that are matched only via sonar.text.inclusions (i.e., not otherwise picked up by sonar.inclusions or a supported language analyzer), does Sonar count their lines of code toward the LOC-based subscription/billing limit?

Thanks!

Hi @Javier,

Your understanding is correct.

Files matched only via sonar.text.inclusions do not count toward LOC.

LOC (the ncloc metric) is produced exclusively by language analyzers, the Java sensor, Python sensor, etc. A file only gets LOC counted if SonarQube assigns it a language and a language analyzer processes it.

Files brought in via sonar.text.inclusions are processed solely by the secrets/text sensor, which:

  • operates on files with no assigned language (that’s the feature, it extends secret detection beyond language-associated files)
  • reports secrets issues only, it emits no LOC metrics

So, no language analyzer runs on those files, no ncloc is produced, and nothing is added to your LOC count.

Hope that helps.

Best regards,

Stevan