# Technical question about secuity

**URL:** <https://community.sonarsource.com/t/technical-question-about-secuity/16253>\
**Category:** SonarQube Server / Community Build\
**Tags:** security\
**Created:** [November 5, 2019, 11:13am UTC](https://community.sonarsource.com/t/technical-question-about-secuity/16253 "2019-11-05T11:13:36Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![marco91](https://avatars.discourse-cdn.com/v4/letter/m/f17d59/32.png) [@marco91](https://community.sonarsource.com/u/marco91)\
**Post date:** [November 5, 2019, 11:13am UTC](https://community.sonarsource.com/t/technical-question-about-secuity/16253/1 "2019-11-05T11:13:36Z")

</div>

Hi  
I would like to have additional informations about sonarqube working but focusing on vulnerabilities analysis.  
In particular i don’t understand how sonarqube performs these analysis and if all the rules (of vulnerabilities) are on an external DB and are retrieved to perform the analysis or it works in a completely different manner.

Then i would like to know how are chosen the estimations to compute some metrics like for example the “Security remediation effort”. I read the documentation and i got an idea, but it is not clear which is the criteria behind the estimation. For example if i define an estimantion to compute the time to fix one line of code, that estimation is completely up to me or there is a mathematical reason?

Thanks

---

<div class="post-metadata">

**Author:** ![ganncamp](https://dub1.discourse-cdn.com/sonarsource/user_avatar/community.sonarsource.com/ganncamp/32/1261_2.png) [@ganncamp](https://community.sonarsource.com/u/ganncamp)\
**Post date:** [November 6, 2019, 4:03pm UTC](https://community.sonarsource.com/t/technical-question-about-secuity/16253/2 "2019-11-06T16:03:30Z")

</div>

Hi,

I have the sense that these questions are coming from an attempt to compare SonarQube with some other tool on an apples-to-apples basis, but I think you’re probably dealing with apples and oranges instead. The [introduction to analysis](https://docs.sonarqube.org/latest/analysis/overview/) might help.

For remediation effort / Technical Debt estimates, they’re just that: estimates. They’re the time that we (SonarSource staff) _estimate_ it would take an average developer to hand an issue on an average day. If you find that some of the estimates are off base, please do tell us.

&nbsp;  
HTH,  
Ann