devopsy.kinsta.cloud

Tag: Sonar

Sonar AI Agent Discovers Vulnerabilities Hidden in Business Logic Workflows

Sonar today made available an artificial intelligence (AI) agent designed to discover vulnerabilities and business logic flaws that pose the greatest risk to an organization should they be exploited.

The SonarQube Hunter Agent first analyzes an entire codebase to find three categories of flaws: broken access control, business-logic vulnerabilities, and authentication or session-management issues.

Satinder Khasriya, a technical product marketing manager for Sonar, said that, historically, discovering these issues would have required manual testing or a penetration test. The AI agent developed by Sonar automates those investigations by tracing how code and data move through a system in a way that can now run on demand, he added.

Additionally, SonarQube Hunter Agent is able to identify the developer who created any piece of code, with verified issues that are surfaced within a DevSecOps workflow via integrations with continuous integration/continuous delivery (CI/CD) platforms.

That’s critical because as advances in AI now make it possible for cybercriminals to discover and exploit vulnerabilities in a matter of hours, DevSecOps teams need to be able to identify issues at machine speed versus waiting until they might be discovered using legacy scanning tools, noted Khasriya. The time to exploitation after a vulnerability has dramatically shrunk, he added.

Deterministic scanning tools are good for catching flaws that look wrong in the code, such as injection vulnerabilities, unsafe data flows, and insecure patterns, but some vulnerabilities aren’t detectable in code, he added. A privilege escalation issue, for example, only becomes visible when there is an understanding of how the code is supposed to function, said Khasriya.

As the threat landscape continues to evolve, it is becoming more critical than ever to discover and verify issues as early as possible in the software development lifecycle, noted Khasriya. Every line of code is now part of the attack surface that DevSecOps teams need to defend, he added. The challenge is that the rate at which that code is being created is overwhelming existing DevSecOps workflows, he added.

It’s already apparent each software engineering team will now need to revisit those workflows sooner than later. Historically, many application development teams might have allocated a few hours a month to creating a patch that might not be deployed for months. In some cases, the exploit of a vulnerability is now being developed faster than the patch needed to remediate it. DevSecOps teams are simultaneously trying to eliminate vulnerabilities in new code while also having to pay down massive amounts of technical debt that has been allowed to accrue for decades. Software engineering teams will need to be able to continuously deploy patches in near real time as quickly as possible, assuming, of course, the patch itself has been verified to be free of malware.

Hopefully, there won’t require multiple application security incidents before organizations allocate the resources needed to safely deploy applications in the AI era. In the meantime, however, DevSecOps teams might be well-advised to, while continuing to hope for the best, prepare now for the worst.

August 27, 2026
Sonar Unfurls Framework for Managing DevOps Workflows in the Age of AI

Sonar this week launched an Agent Centric Development Cycle (AC/DC) framework that promises to modernize continuous integration (CI) in the age of artificial intelligence (AI) coding.

Announced at an online Sonar Summit, the AC/DC framework incorporates multiple tools and platforms the company has developed to better secure software supply chains, including now in beta Sonar Context Augmentation tool that provides guidance in real-time to AI coding tools and a SonarQube Agentic Analysis service to analyze code that can be accessed via a command line interface (CLI) or Model Context Protocol (MCP) server provided by Sonar.

Additionally, Sonar is now making available in beta a SonarQube Remediation Agent that automatically repairs quality gate blockers in pull requests.

Sonar is also now making generally available a previously launched SonarQube Architecture service to provide DevOps teams with a systems-level view of blueprints that can then be used to automatically detect architectural drift.

Finally, Sonar is also making available in beta a tool for builders of large language models (LLMs), dubbed Sonar Sweep, that remediates the code being used to train them to help ensure higher quality output.

Lauren Hanford, a product leader for Sonar, said as AI coding tools are embedded into workflows there is a clear need for a change to CI workflows. Precisely how those workflows will need to adapt to accommodate AI coding agents has not yet been fully determined, but the need for greater governance and tools to discover and remediate vulnerabilities in code is becoming apparent, she added.

For example, in many cases AI agents will be directly invoking tools and platforms to perform a task in collaboration with other AI agents but a set of best practices for managing those interactions has yet to be defined, said Hanford. Otherwise, DevOps teams might soon find their workflows are being overwhelmed by continuous pull requests, she noted.

In the absence of those best practices, it also becomes more difficult to onboard an AI agent in a way that focuses them on a specific task or role, versus trying to continually access code that may now be outdated or simply represent some type of technical debt that has not yet been addressed, said Hanford.

Mitch Ashley, vice president and practice lead for software lifecycle engineering for the Futurum Group, said the era of simply scanning code and reporting the results later is over. If agents are writing the code, security and quality analysis must live inside the agent’s context window, not only as a post-commit process, he added.

This is where security, observability, and governance friction is eliminated by design, noted Ashley.

The pace at which AI coding tools are being adopted naturally varies but just about every DevOps team by now has at least experimented with these tools, with a significant portion now moving to incorporate AI coding tools into their workflows. The challenge, of course, is finding a way to govern those workflows to ensure that the output being created doesn’t wind up creating more trouble than it’s actually worth.

March 4, 2026
Sonar Adds Ability to Analyze Architecture of Applications to Code Analysis Tool

Sonar this week revealed it has added an ability to analyze the architecture of a software application to its SonarQube tool for analyzing code quality.

Available in beta and scheduled to be made generally available in the first quarter, the addition to SonarQube promises to make it simpler to understand the actual structure of an application versus what might have been initially intended.

Sonar chairman and founder Olivier Gaudin said that capability plays a critical role in preventing applications from potentially crashing as changes are made over time. In fact, the less attention that is paid to best architecture practices the greater the odds become that the amount of time and effort required to add new capabilities to an application will increase, noted Gaudin.

The ultimate goal is to reduce the likelihood that an application might one day have to be entirely rewritten as changes that deviated from the original architectural plan take their toll in the form of technical debt that eventually needs to be addressed, he added.

In effect, SonarQube is now able to reverse engineer an application by analyzing the code used to construct it. DevOps teams can then use those insights to define a structure for new and existing components, including the relationships between components, to create a blueprint for developers to follow while coding. SonarQube then performs automated reviews against your established architectural blueprint to surface gaps and deviations that can be addressed within the context of a DevOps workflow, said Gaudin.

It’s not clear how often organizations are rewriting applications because they have evolved in a way that proves unsustainable, but as application development teams rely more on artificial intelligence (AI) tools to write code it becomes more probable these types of issues will be encountered, noted Gaudin.

On the plus side, the ability to analyze architecture should make it easier for AI agents to more accurately assess applications in a way that ultimately serves to improve quality, he added. Longer term, the goal is to enable AI tools to automatically remediate issues that arise as developers are writing code, noted Gaudin

In the meantime, however, the number of architecture-related issues that DevOps teams are going to encounter is only going to increase as, for example, developers embrace so-called vibecoding tools to generate application code, he added.

Previously, Sonar has made available training tools to providers of large language models (LLMs) that are designed to help reduce the number of security vulnerabilities and bugs that might be generated, but it might be a while yet before the impact of the tools is seen in the output of the code being generated. For now, the quality of the code being generated by LLMs will continue to vary widely depending on the LLM being invoked.

DevOps teams, as a result, would be well-advised to double down on code reviews today that, all too often in the past in the name of expediency, were not always rigorously conducted as they should have been as application developers strove to add new capabilities to applications as quickly as possible no matter what the real ultimate cost might be.

December 18, 2025
Strengthening Software Trust in Modern DevOps Workflows

At swampUP 2025 in Napa Valley, Alan Shimel sat down with Tariq Shaukat, CEO of Sonar, and Gal Marder, EVP of Strategy at JFrog, for a discussion on how partnerships across the DevOps and AI ecosystems are reshaping the way software is built, secured and delivered.

Shaukat emphasized that Sonar’s relationship with JFrog is rooted in shared values around trust, transparency, and code quality. As AI continues to accelerate software creation, both companies see a growing need for solutions that help developers not only move faster but also maintain the highest levels of security and reliability. “It’s never been about how fast developers type,” Shaukat noted. “It’s about ensuring that what’s being built is safe, verifiable, and ready for production.”

The discussion also touched on the rising influence of AI in DevOps workflows and the responsibility that comes with it. Shaukat and Marder agreed that as teams adopt AI tools to generate, test, and deploy code, governance must evolve to keep pace. That’s where the partnership between Sonar and JFrog becomes especially relevant—bridging code integrity with artifact management, vulnerability detection, and software supply chain security.

Marder added that this collaboration exemplifies JFrog’s broader strategy to build a unified, secure DevOps ecosystem powered by trusted partnerships. Together, Sonar and JFrog are working to redefine how software quality and trust are measured in an era where AI agents, automation, and human developers all share the same pipeline.

October 14, 2025
Sonar Adds Secrets Detection to Code Analysis Portfolio

Sonar has added a secrets detection capability to its portfolio of tools for analyzing code and DevOps workflows.

Designed to be applied to both finding secrets in code repositories and as applications are developed using an integrated development environment (IDE), this capability is being added to SonarLint, SonarQube and the managed SonarCloud service to identify, for example, passwords, application programming interface (API) keys, encryption keys, tokens, database credentials and other private information.

Sonar co-CEO Olivier Gaudin said the goal is to eliminate secrets that are accidentally or maliciously stored in source code to improve software supply chain security.

While it’s important to discover secrets in codebases, Sonar is making a concerted effort to make it simpler for developers to discover secrets before they find their way into a codebase that is one step away from a production environment, noted Gaudin. The SonarLint static analysis tool the company provides can now discover secrets in microseconds using the syntactic and semantic analysis engines the company has now extended, he added. No developer is going to wait five to 10 minutes for a code scan to be completed, said Gaudin.

A Learn as You Code tool also explains how each secret found in a code segment poses a security risk. The overall goal is not only to remove secrets but, ultimately, reduce the number of instances where secrets are discovered in code, said Gaudin.

Most organizations today are at varying stages of embracing DevSecOps best practices to improve software supply chain security. It’s not clear how readily secrets management is being embraced as part of those modernization efforts, but as cybercriminals routinely scan for application secrets stored in clear text that can be used to compromise application security, the need to encrypt secrets becomes a higher priority.

There is, of course, no shortage of tools for detecting secrets. Sonar is now simply making a case for managing secret detection as part of a larger effort to reduce vulnerabilities in code that cybercriminals can exploit. That approach should help reduce the total cost of securing a software supply chain at a time when forthcoming regulations are going to make organizations that deploy software more accountable for application security.

In the meantime, thanks to the rise of generative artificial intelligence (AI), the volume of code that needs to be scanned will likely exponentially increase. The issue with general-purpose AI platforms such as ChatGPT is they were trained using code of varying quality that often contains vulnerabilities that are now sometimes incorporated into the code they generate. On the plus side, however, many developers have little to no application security expertise, so it’s just as feasible that ChatGPT will create more secure code than a human developer. Regardless of how the code was created, however, no one will know for sure how secure it is without scanning it first.

Hopefully, as AI progresses, the quality of the code being generated will only continue to improve. Until then, DevOps teams should continue to assume all code is suspect until proven otherwise.

December 18, 2023
31 Reference Architectures for DevOps and Continuous Delivery
At QCon London, David Farley (@davefarley77) told the audience that “continuous delivery changes the economics of software delivery”. I could not agree more.

If you have been drawn to the evangelists like David Farley, Jez Humble, and Gene Kim, you’ll know that high performance IT organizations are seeing a massive payoff in their continuous delivery investments. Industry leaders big and small are sharing noticeable results:
- 8x more frequent production deployments
- 50% lower change failure rates
- 12x faster service restoration times when something went wrong
5 Principles

How are they achieving these results? They are following a few key principles that David and Jez outlined in their seminal book, Continuous Delivery (highly recommended). The principles outlined in their book and in David’s QCon presentation are as follows:
- Deliver fast
- Automate almost everything
- Keep everything in version control
- Build quality In
- Empower the team
Reference Architectures for DevOps and Continuous Delivery

In their book, they also provide insight to continuous delivery tool chains and processes which highlight build tools, CI platforms, testing suites, artifact repositories, and many other components. There are numerous examples of reference architectures available, and each of them vary in levels of detail, tools highlighted, and processes followed. Yet, there is a constant theme among the tool sets: Jenkins, Maven, Nexus, Subversion, Git, Docker, Puppet/Chef, Rundeck, and Sonar seem to show up time and again.

To help you along your continuous delivery and DevOps journey, I have compiled a set of 31 reference architectures created by users across the continuous delivery and DevOps communities.

Each architecture is accompanied by a link to the original presentation or blog where the architecture was referenced to ensure you have access to the full context of the discussion. You can also freely download the presentation from SlideShare where we now have over 7,000 views.

Offer to help others: If you have a reference architecture to share, please consider posting a link to it in the comments section below. I am sure others would love to see it and learn from it.
April 22, 2015