DevOps PeachSAST in the security-testing picture
| Type | Reads | When | Example tools |
|---|---|---|---|
| SAST (Static) | Source code | While coding, on PRs | SonarQube, Semgrep, CodeQL |
| SCA | Dependencies | At build | Trivy, Dependabot, OWASP Dependency-Check |
| DAST (Dynamic) | The running app | After a test deploy | OWASP ZAP |
| Secret scanning | Code and history | Commit, PR | gitleaks |
SAST finds defects such as SQL injection from string concatenation, weak hash algorithms, skipped TLS certificate checks, null pointers and unclosed resources. Its strengths are running early and pointing at the exact line; its weaknesses are false positives and blindness to runtime configuration.
SonarQube
SonarQube (Sonar's self-managed edition; the SaaS edition is SonarQube Cloud, formerly SonarCloud) analyses more than 30 languages, including IaC such as Terraform, Dockerfiles and Kubernetes YAML. Results fall into:
| Issue type | Meaning |
|---|---|
| Bug | Code likely to behave incorrectly |
| Vulnerability | A security flaw to fix |
| Security Hotspot | Sensitive code a human reviewer must confirm is safe |
| Code Smell | Hard to maintain: long functions, duplication, high complexity |
Beyond issues, the dashboard shows coverage (read from the test tool's report), duplication and A–E ratings for reliability, security and maintainability.
SonarQube does not run unit tests; it only imports coverage reports (JaCoCo, lcov…) produced by the test step.
SonarLint: instant feedback in the IDE
flowchart LR D["Developer writes code"] --> L["SonarLint in the IDE<br/>underlines at once"] L --> P["git push / PR"] P --> Q["SonarQube in CI<br/>dashboard + Quality Gate"] Q -- "Failed" --> D
SonarLint (now SonarQube for IDE) is a plugin for VS Code, IntelliJ, Eclipse and Visual Studio. It runs locally and flags problems as you type. In connected mode it shares the rule set (Quality Profile) with the server, so developers and CI agree.
Common traps
- Confusing SonarLint (local) with SonarQube (the server in CI).
- Treating every issue as real and fixing mechanically; mark false positives with a reason.
- Running SonarQube without a blocking Quality Gate, so nobody looks at the dashboard.
- Thinking SAST replaces human review or DAST.