# SonarCloud Community: we’ve elevated Security Hotspots to first-class citizen status **URL:** \ **Category:** Announcements\ **Tags:** security-hotspot\ **Created:** [May 10, 2019, 6:58am UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593 "2019-05-10T06:58:44Z")\ **Posts on this page:** 13\ **Page:** 1
**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Post date:** [May 10, 2019, 6:58am UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/1 "2019-05-10T06:58:44Z")
Hello SonarCloud Community, We’ve made some changes to SonarCloud pertaining to features in the security domain. Here’s an update on these changes to help you understand them and quickly integrate them into your organization. First, we’ve elevated[Security Hotspots](https://sonarcloud.io/documentation/user-guide/security-hotspots/) to first-class citizen status. They now belong to the Security domain alongside vulnerabilities. For vulnerabilities, there is no change, they are proper issues and require a fix. On the other hand, Security Hotspots, require a different action set. They need a careful review to properly categorize them - either they fall into the issue bucket (and become true vulnerabilities) or they can be safely ignored. To assist with this triage, we highlight Security Hotspots in your PR analysis so you know where to focus your attention. They’re also visible on the Overview Page of your project. On the Issues page, we’ve added a reminder to explain the action needed for Security Hotspots: ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/2X/3/3a2798af49c2a263beff9b60655ea53d844e5b4d.png) We were careful to display Security Hotspots differently so it’s clear that they require a different action from ‘normal’ issues. A proper Security Hotspot workflow involves review and a bit of inspection along with probing questions to ensure your code isn’t linking to a known security attack or weakness. We also break things down into Security Categories (SonarSource, OWASP Top 10 and SANS Top 25) so it’s easier to understand the effort (code fixes vs. code review/fix) involved in order to resolve all items. ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/2X/9/9de21ffb25627fb3615f54040cab3225755db333.png) Finally, we removed the “Security Reports” feature. As a developer, reports are not as useful as an actionable list of issues and this is provided by the Issues Page and its new Security Category filter. Soon, we’ll add a bit more clarity to the Security Hotspot workflow by incorporating a clear action status: _To Review_ \> _In Review_ \> _Reviewed_. As always, we love your feedback! Please reach out on this forum if you have questions or comments! Happy coding! ---
**Author:** ![RobCo](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/robco/32/36124_2.png) [@RobCo](https://community.sonarsource.com/u/RobCo)\ **Post date:** [February 25, 2020, 8:37am UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/3 "2020-02-25T08:37:45Z")
Hey @Alexandre_Gigleux, is there a plan to make Security Hotspots visible in the IDE? SonarLint still doesn’t report Security Hotspots. Cheers, Robin ---
**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Post date:** [February 25, 2020, 8:55am UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/4 "2020-02-25T08:55:09Z")
Hello, Yes, I confirm we want to bring Security Hotspots into SonarLint in 2020 and we don’t want to mix them up in the middle of Issues so we need to work on new UI for that. Alex ---
**Author:** ![RobCo](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/robco/32/36124_2.png) [@RobCo](https://community.sonarsource.com/u/RobCo)\ **Post date:** [February 25, 2020, 8:57am UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/5 "2020-02-25T08:57:05Z")
Hey Alex, that’s great to hear! Looking forward to this feature! Cheers, Robin ---
**Author:** ![yahanvesh](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/yahanvesh/32/10102_2.png) [@yahanvesh](https://community.sonarsource.com/u/yahanvesh)\ **Post date:** [March 12, 2020, 2:16pm UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/6 "2020-03-12T14:16:37Z")
+1 on that! ---
**Author:** ![jsupple](https://avatars.discourse-cdn.com/v4/letter/j/73ab20/32.png) [@jsupple](https://community.sonarsource.com/u/jsupple)\ **Post date:** [July 20, 2020, 4:51pm UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/7 "2020-07-20T16:51:57Z")
Seconding that we want security hotspots as an option in SonarLint! Thank you! ---
**Author:** ![gmaize](https://avatars.discourse-cdn.com/v4/letter/g/7bcc69/32.png) [@gmaize](https://community.sonarsource.com/u/gmaize)\ **Post date:** [November 17, 2020, 8:31pm UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/8 "2020-11-17T20:31:19Z")
@Alexandre_Gigleux wanted to chime in and see if there’s any update on the effort to get security hotspots integrated with Sonarlint? Is there a better place for me to track the feature status for this item? thank you and the team for your work! - Gianni ---
**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Post date:** [November 18, 2020, 12:26pm UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/9 "2020-11-18T12:26:41Z")
Hello, Thanks for asking. This is what is coming if everything goes well with SQ 8.6 and later in SonarCloud: ![image](https://europe1.discourse-cdn.com/sonarsource/uploads/sonarcommunity/original/3X/b/4/b4f16edb8575c44462247cb50bf1b5b0bf6101d0.png) You should soon be able to start your Security Hotspots review from SonarQube/SonarCloud and jump into your IDE easily to continue your investigation. See: - [MMF-2167](https://jira.sonarsource.com/browse/MMF-2167) - [MMF-2187](https://jira.sonarsource.com/browse/MMF-2187) SonarCloud will also soon get the new Security Hotspots experience that was introduced a couple of months ago on SonarQube. See: [MMF-2176](https://jira.sonarsource.com/browse/MMF-2176) Regards Alex ---
**Author:** ![StingyJack](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/stingyjack/32/13336_2.png) [@StingyJack](https://community.sonarsource.com/u/StingyJack)\ **Post date:** [May 24, 2021, 5:10pm UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/10 "2021-05-24T17:10:45Z")
@Alexandre_Gigleux - Is there a way to bulk edit these hotspots? I have 26 of the same thing in a file and all of them are safe. I dont want to click each one and type in a comment and pick a radio button and save it ---
**Author:** ![Alexandre\_Gigleux](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/alexandre_gigleux/32/26_2.png) [@Alexandre\_Gigleux](https://community.sonarsource.com/u/Alexandre_Gigleux)\ **Post date:** [May 25, 2021, 6:58am UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/11 "2021-05-25T06:58:56Z")
There is no way to bulk update a list of Security Hotspots as of now. ---
**Author:** ![StingyJack](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/stingyjack/32/13336_2.png) [@StingyJack](https://community.sonarsource.com/u/StingyJack)\ **Post date:** [May 26, 2021, 1:16pm UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/12 "2021-05-26T13:16:44Z")
It would be great to not have to pay so much of a a time penalty for false positives. After all, they are not a mistake on the users part. ---
**Author:** ![Pierre-Loup\_Tristant](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/pierre-loup_tristant/32/3191_2.png) [@Pierre-Loup\_Tristant](https://community.sonarsource.com/u/Pierre-Loup_Tristant)\ **Post date:** [May 26, 2021, 1:53pm UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/13 "2021-05-26T13:53:29Z")
Hi @StingyJack, It would be nice if you could create a new thread in [False-positive - SonarSource Community](https://community.sonarsource.com/c/bug/fp/7) to report this false positive. Providing a code example would greatly help. Thank you. ---
**Author:** ![StingyJack](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/stingyjack/32/13336_2.png) [@StingyJack](https://community.sonarsource.com/u/StingyJack)\ **Post date:** [June 1, 2021, 8:04pm UTC](https://community.sonarsource.com/t/sonarcloud-community-we-ve-elevated-security-hotspots-to-first-class-citizen-status/9593/14 "2021-06-01T20:04:15Z")
I’m hinting that you take that advice into consideration when designing any new feature. Asking for a single FP to be fixed hasn’t been a productive use of my time.