Thanks!
I think the most useful indicator of where the problem is would come from turning on TRACE level logs (global Administration > System > Log Level) performing the action and then pinging directly in your browser the /api/security_reports/show?project=xxx&standard=sonarsourceSecurity&includeDistribution=false endpoint (to avoid other noise).
For example, this is the output on my machine:
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=0ms | sql=SELECT sa.scm_account as "scm_account", u.uuid as uuid, u.login as login, u.name as name, u.email as email, u.active as "active", u.salt as "salt", u.crypted_password as "cryptedPassword", u.hash_method as "hashMethod", u.external_id as "externalId", u.external_login as "externalLogin", u.external_identity_provider as "externalIdentityProvider", u.user_local as "local", u.reset_password as "resetPassword", u.homepage_type as "homepageType", u.homepage_parameter as "homepageParameter", u.last_connection_date as "lastConnectionDate", u.last_sonarlint_connection as "lastSonarlintConnectionDate", u.created_at as "createdAt", u.updated_at as "updatedAt" FROM users u left outer join scm_accounts sa on sa.user_uuid = u.uuid WHERE u.uuid=? | params=ad2aae27-14d9-4b04-b18f-d7a022853c5f
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=1ms | sql=select case when exists ( select c.uuid from components c where c.kee in ( ? ) and c.scope = 'PRJ' and c.qualifier in ( ? , ? , ? ) ) then 1 else 0 end | params=aws, VW, SVW, APP
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=0ms | sql=select case when exists ( select pb.project_uuid, pb.need_issue_sync from project_branches pb join components c on pb.uuid = c.branch_uuid where c.kee in ( ? ) and pb.need_issue_sync = true ) then 1 else 0 end | params=aws
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=1ms | sql=select p.uuid as uuid, p.uuid_path as uuidPath, p.branch_uuid as branchUuid, p.kee as kee, case when pr.name is not null and p.scope = 'PRJ' then pr.name else p.name end as name, case when pr.name is not null and p.scope = 'PRJ' then pr.name else p.long_name end as longName, p.description as description, p.qualifier as qualifier, p.scope as scope, p.language as language, p.path as path, p.enabled as enabled, p.copy_component_uuid as copyComponentUuid, p.private as isPrivate, p.created_at as createdAt from components p left join project_branches pb on pb.uuid = p.branch_uuid left join projects pr on pb.project_uuid = pr.uuid where p.kee=? AND (pb.is_main = true OR (pb.uuid is NULL AND (p.qualifier IN ('VW', 'SVW') OR (p.qualifier = 'TRK' AND p.scope = 'FIL')))) | params=aws
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=0ms | sql=select pb.uuid as uuid, pb.project_uuid as projectUuid, pb.kee as kee, pb.branch_type as branchType, pb.merge_branch_uuid as mergeBranchUuid, pb.pull_request_binary as pullRequestBinary, pb.exclude_from_purge as excludeFromPurge, pb.need_issue_sync as needIssueSync, pb.is_main as isMain from project_branches pb where pb.uuid = ? | params=7b863eed-e5ca-41ec-af6e-9f6ae57bf822
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=0ms | sql=SELECT p.uuid as uuid, p.uuid_path as uuidPath, p.branch_uuid as branchUuid, p.kee as kee, p.name as name, p.long_name as longName, p.description as description, p.qualifier as qualifier, p.scope as scope, p.language as language, p.path as path, p.enabled as enabled, p.copy_component_uuid as copyComponentUuid, p.private as isPrivate, p.created_at as createdAt FROM components p where p.uuid=? | params=7b863eed-e5ca-41ec-af6e-9f6ae57bf822
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=0ms | sql=select pb.uuid as uuid, pb.project_uuid as projectUuid, pb.kee as kee, pb.branch_type as branchType, pb.merge_branch_uuid as mergeBranchUuid, pb.pull_request_binary as pullRequestBinary, pb.exclude_from_purge as excludeFromPurge, pb.need_issue_sync as needIssueSync, pb.is_main as isMain from project_branches pb where pb.uuid = ? | params=7b863eed-e5ca-41ec-af6e-9f6ae57bf822
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=0ms | sql=(select p.uuid as uuid, p.kee as kee, p.name as name, p.private as isPrivate, p.description as description, p.qualifier as qualifier, null as authUuid from projects p where p.uuid = ?) UNION (select p.uuid as uuid, p.kee as kee, p.name as name, p.private as isPrivate, p.description as description, case when p.parent_uuid is null then 'VW' else 'SVW' end as qualifier, case when p.root_uuid != p.uuid then p.root_uuid else null end as authUuid from portfolios p where p.uuid = ?) | params=e04f849f-eb01-4ab0-8909-b06472b336f5, e04f849f-eb01-4ab0-8909-b06472b336f5
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=0ms | sql=select ur.role from user_roles ur inner join ( (select p.uuid as uuid, p.kee as kee, p.name as name, p.private as isPrivate, p.description as description, p.qualifier as qualifier, null as authUuid from projects p) UNION (select p.uuid as uuid, p.kee as kee, p.name as name, p.private as isPrivate, p.description as description, case when p.parent_uuid is null then 'VW' else 'SVW' end as qualifier, case when p.root_uuid != p.uuid then p.root_uuid else null end as authUuid from portfolios p where p.parent_uuid is null) ) entity on entity.uuid = ur.entity_uuid where entity.uuid = ? and ur.user_uuid = ? union select gr.role from group_roles gr inner join groups_users gu on gr.group_uuid = gu.group_uuid inner join ( (select p.uuid as uuid, p.kee as kee, p.name as name, p.private as isPrivate, p.description as description, p.qualifier as qualifier, null as authUuid from projects p) UNION (select p.uuid as uuid, p.kee as kee, p.name as name, p.private as isPrivate, p.description as description, case when p.parent_uuid is null then 'VW' else 'SVW' end as qualifier, case when p.root_uuid != p.uuid then p.root_uuid else null end as authUuid from portfolios p where p.parent_uuid is null) ) entity on entity.uuid = gr.entity_uuid where entity.uuid = ? and gu.user_uuid = ? union select gr.role from group_roles gr inner join ( (select p.uuid as uuid, p.kee as kee, p.name as name, p.private as isPrivate, p.description as description, p.qualifier as qualifier, null as authUuid from projects p) UNION (select p.uuid as uuid, p.kee as kee, p.name as name, p.private as isPrivate, p.description as description, case when p.parent_uuid is null then 'VW' else 'SVW' end as qualifier, case when p.root_uuid != p.uuid then p.root_uuid else null end as authUuid from portfolios p where p.parent_uuid is null) ) entity on entity.uuid = gr.entity_uuid where entity.uuid = ? and gr.group_uuid is null | params=e04f849f-eb01-4ab0-8909-b06472b336f5, ad2aae27-14d9-4b04-b18f-d7a022853c5f, e04f849f-eb01-4ab0-8909-b06472b336f5, ad2aae27-14d9-4b04-b18f-d7a022853c5f, e04f849f-eb01-4ab0-8909-b06472b336f5
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=1ms | sql=select p.prop_key as "key", p.is_empty as empty, p.text_value as textValue, p.clob_value as clobValue, p.entity_uuid as entityUuid, p.user_uuid as userUuid from properties p where p.prop_key=? and p.entity_uuid is null and p.user_uuid is null | params=sonar.multi-quality-mode.enabled
2025.02.13 11:15:51 DEBUG web[c8dcab7c-26c6-43c9-948d-35087d583497][j.io.serialization] Builtin factory: null -> new: null
... Elasticsearch
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=0ms | sql=select m.component_uuid as componentUuid, m.branch_uuid as branchUuid, m.json_value as jsonValue, m.json_value_hash as jsonValueHash from measures m where m.component_uuid in ( ? ) | params=7b863eed-e5ca-41ec-af6e-9f6ae57bf822
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=5ms | sql=select a.uuid, a.profile_uuid as "profileUuid", a.rule_uuid as "ruleUuid", a.failure_level as "severity", a.inheritance as "inheritance", a.impacts as "impactsString", a.prioritized_rule as "prioritizedRule", a.created_at as "createdAt", a.updated_at as "updatedAt", r.plugin_rule_key as "rulefield", r.plugin_name as "repository", r.security_standards as "securityStandards", r.is_external as "isExternal", r.name as "name", r.plugin_config_key as "configKey", r.template_uuid as "templateUuid", r.language as "language", oqp.uuid as "orgProfileUuid" from active_rules a inner join rules_profiles rp on rp.uuid = a.profile_uuid inner join org_qprofiles oqp on oqp.rules_profile_uuid = rp.uuid inner join rules r on r.uuid = a.rule_uuid and r.status != 'REMOVED' where r.rule_type in ( ? , ? ) and oqp.uuid in ( ? , ? , ? , ? , ? , ? , ? ) | params=4, 3, 41cef59a-da80-41ca-8bf9-65bab208a279, 512b626c-ce4b-4d84-990c-68e10671efb6, 6645f742-66d2-42a2-8f98-8db6063dd642, 6d2a9796-9b45-48b7-939b-d24c1d3b2590, b19235ac-1a42-4b94-84ce-aa9c82236895, cb860833-0543-4f1c-b991-d92bfc2a06e3, ce13af20-66b6-4b53-9680-26859313e8d2
2025.02.13 11:15:51 TRACE web[c8dcab7c-26c6-43c9-948d-35087d583497][sql] time=32ms | sql=select rdi.rule_uuid as "rdi_ruleUuid", rdi.software_quality as "rdi_softwareQuality", rdi.severity as "rdi_severity", CASE WHEN rt.is_system_tag = true THEN rt.value ELSE NULL END as rt_systemTags, CASE WHEN rt.is_system_tag = false THEN rt.value ELSE NULL END as rt_tags, rt.is_system_tag as "rt_isSystemTag", rt.value as "rt_value", rds.content as "rds_content", rds.uuid as "rds_uuid", rds.kee as "rds_kee", rds.context_key as "rds_contextKey", rds.context_display_name as "rds_contextDisplayName", r.uuid as "r_uuid", r.plugin_rule_key as "ruleKey", r.plugin_name as "repositoryKey", r.description_format as "descriptionFormat", r.status, r.name, r.plugin_config_key as "configKey", r.priority as "severity", r.is_template as "isTemplate", r.is_external as "isExternal", r.is_ad_hoc as "isAdHoc", r.language as "language", r.template_uuid as "templateUuid", r.def_remediation_function as "defRemediationFunction", r.def_remediation_gap_mult as "defRemediationGapMultiplier", r.def_remediation_base_effort as "defRemediationBaseEffort", r.gap_description as "gapDescription", r.security_standards as "securityStandardsField", r.rule_type as "type", r.plugin_key as "pluginKey", r.scope, r.created_at as "createdAt", r.updated_at as "updatedAt", r.note_data as "noteData", r.note_user_uuid as "noteUserUuid", r.note_created_at as "noteCreatedAt", r.note_updated_at as "noteUpdatedAt", r.remediation_function as "remediationFunction", r.remediation_gap_mult as "remediationGapMultiplier", r.remediation_base_effort as "remediationBaseEffort", r.ad_hoc_name as "adHocName", r.ad_hoc_description as "adHocDescription", r.ad_hoc_severity as "adHocSeverity", r.ad_hoc_type as "adHocType", r.education_principles as "educationPrinciplesField", r.clean_code_attribute as "cleanCodeAttribute" from rules r left outer join rule_desc_sections rds on rds.rule_uuid = r.uuid left outer join rules_default_impacts rdi on rdi.rule_uuid = r.uuid left outer join rule_tags rt on rt.rule_uuid = r.uuid where r.status != 'REMOVED' and r.is_external=false and r.is_template=false and r.rule_type in ( ? , ? ) and r.language in ( ? , ? , ? , ? , ? , ? , ? ) order by r.uuid | params=4, 3, c, cpp, docker, kotlin, py, ts, xml
The goal here is to narrow down specifically which SQL call is resulting in an error, and try to understand why.