Hello Community, We’re excited to announce a significant enhancement to our secret detection capabilities: Sonar now analyzes YAML and JSON files for leaked secrets! The Problem YAML and JSON files are widely used to configure and deliver software. It’s easy to accidentally paste a secret into th…

Hi @Alexandre_Gigleux Great stuff! Do you have any ETA for the DOTNET scanner? Also what version of SonarQube Server and what version of the CLI scanner are required for this to work? thanks Tony

Hello, You need SonarQube Server 2025.4 For the Scanner CLI, there is no specific version required. Alex

Thanks Alex - I am guessing the DOTNET version is similar to my question elsewhere - you have no ETA for this? Though if no specific version of the CLI scanner is required to support ti then why is it limited to the CLI scanner at the moment and you need to work on updating the other ones? thanks …

Hello, I’d like to share a quick update on our progress. We are changing our approach: instead of keeping this feature deactivated by default, we will activate it by default for a portion of SonarQube Cloud organizations. This will be done through a progressive rollout until all organizations have …

Hi @Alexandre_Gigleux Can you confirm whether this is still a partial rollout for SonarQube Cloud organizations, or if it has now been rolled out to all customers by default?

To ensure a smooth experience, we’ve slowed the automatic rollout of YAML/JSON scanning. This prevents organizations from reaching their line limits prematurely. If you’d like to use this feature immediately, it is fully available for manual activation within your settings.

Sonar now analyzes YAML and JSON files for secrets

Sonar Updates

Topic		Replies	Views
Support of YAML/JSON by the Azure DevOps SonarCloud extension? Rules and Languages scanner	1	94	September 16, 2025
Secret detection in yaml files SonarQube Server / Community Build scanner , security , secrets , yaml	1	251	November 27, 2024
Why SonarQube is not Scanning YAML Configuration file in spring boot SonarQube Server / Community Build java , sonarqube , scanner	3	2963	July 17, 2025
Hardcoded secrets in YAML not detected SonarQube Server / Community Build sonarqube , scanner , secrets , yaml	2	124	August 20, 2025
Analysing YAML files with SonarCloud SonarQube Cloud	2	1961	February 12, 2024

Sonar now analyzes YAML and JSON files for secrets

Related topics