Hi @aldo
I have found that there are rules with high severity […] that are not checked by default
Why these rules are not checked if they had a high severity?
Some rules might be considered as too specific/too opinionated/too verbose to be enabled by default. But still we might consider that when they apply, the severity is high.
However, we are open to feedback, let us know the rules you think should be on by default.
e.g. “NullPointerException” should not be caught
I think this rule ( java:S1696) was disabled by default because some people use NPE as a control flow/validation checks, but maybe we could reconsider. @Quentin any opinion?
Also, the amount of rules in the web seems to be higher than the amount of rules in the eclipse plugin.
You can see in the FAQ all documented reasons: mainly all taint vulnerabilities detected by our security engine are not available directly in SonarLint, as well as security hotspots.