# Support for scanning OSS

**URL:** <https://community.sonarsource.com/t/support-for-scanning-oss/120409>\
**Category:** SonarQube Server / Community Build\
**Tags:** sonarqube, scanner\
**Created:** [August 8, 2024, 12:28pm UTC](https://community.sonarsource.com/t/support-for-scanning-oss/120409 "2024-08-08T12:28:53Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![nanshua](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nanshua](https://community.sonarsource.com/u/nanshua)\
**Post date:** [August 8, 2024, 12:28pm UTC](https://community.sonarsource.com/t/support-for-scanning-oss/120409/1 "2024-08-08T12:28:53Z")

</div>

Does Sonar has the capability to scan code and find out if we are using any open source software and if so what is the license? Similar to what Blackduck / FOSSA does? Any third party integrations/plugins possible?

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [August 9, 2024, 2:23pm UTC](https://community.sonarsource.com/t/support-for-scanning-oss/120409/2 "2024-08-09T14:23:37Z")

</div>

Hi,

Welcome to the community!

That’s Software Composition Analysis (SCA). We do Static Application Security Testing (SAST), which is an examination of the code to find vulnerabilities.

&nbsp;  
HTH,  
Ann

---

<div class="post-metadata">

**Author:** ![nanshua](https://avatars.discourse-cdn.com/v4/letter/n/ce7236/32.png) [@nanshua](https://community.sonarsource.com/u/nanshua)\
**Post date:** [August 10, 2024, 4:32pm UTC](https://community.sonarsource.com/t/support-for-scanning-oss/120409/3 "2024-08-10T16:32:35Z")

</div>

Finding Vulnerabilities is one thing, what I need is if Sonar can scan our code and find all Open Source Software and their licenses ?

Few of the products which does the same are FOSSA and Blackduck.

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [August 12, 2024, 12:03pm UTC](https://community.sonarsource.com/t/support-for-scanning-oss/120409/4 "2024-08-12T12:03:45Z")

</div>

Hi,

We don’t do SCA.

&nbsp;  
HTH,  
Ann

---

<div class="post-metadata">

**Author:** ![Colin](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/colin/32/55255_2.png) [@Colin](https://community.sonarsource.com/u/Colin)\
**Post date:** [March 18, 2025, 2:28pm UTC](https://community.sonarsource.com/t/support-for-scanning-oss/120409/6 "2025-03-18T14:28:02Z")

</div>

Hello from the future!

We recently announced SonarQube Advanced Security, which will include SCA capabilities. While it’s not available yet, we expect general availability for SonarQube Server in May 2025, and SonarQube Cloud Enterprise shortly after.

Please see this announcement for more details.

> [@Announcing SonarQube Advanced Security](https://community.sonarsource.com/t/announcing-sonarqube-advanced-security/136625):
>
> Sonar is excited to [announce SonarQube Advanced Security](https://www.sonarsource.com/company/press-releases/sonar-extends-code-security-coverage-with-sonarqube-advanced-security/), extending SonarQube’s analysis capabilities beyond first-party and AI-generated code to include third-party open source code. With this, we’re delivering the first fully integrated solution for finding and fixing code quality and code security issues in the development phase of the SDLC. The first step in integrating Sonar’s recent acquisition of Tidelift, SonarQube Advanced Security strengthens a robust set of existing security capabili…