Insights

Setting and maintaining development standards is essential to creating reusable and sustainable code. Implementing automated code analysis tools helps to do so conveniently and effectively across multiple project domains.

SonarCloud is one of the best ways of doing so, and it is a cloud-based code quality and security service that allows you to set custom quality requirements for your code along with the generic ones that come as standard with the service.

General monitored metrics include:

• Code Duplication
• Complexity Levels
• Security Vulnerabilities
• Coverage

Additionally, you can define quality gates (a set of measure based Boolean conditions) to create a customised standard for each deployment. This allows the DevSecOps team to identify bugs and inconsistencies seconds after the deployment.

You will save a lot of time and pain for both you and your client, as nothing will be deployed to production without passing all quality gate requirements.

During the first implementation of SonarCloud with one of our clients, we identified a version conflict in the code missed by the development team. In doing so, we averted the deployment of an AWS infrastructure that wouldn’t have been able to deploy the container required by the client.

Some examples of SonarCloud detecting security vulnerabilities in code after first being implemented include identifying committed hardcoded passwords. SonarCloud can analyse the code to search for instances where passwords are hard-coded within the code itself, a common mistake that can lead to security breaches. Additionally, SonarCloud could detect weak hash algorithms that have been used within the code, making it easier for attackers to access sensitive data.

Another issue that SonarCloud has flagged is when security keys are inadvertently pushed to GitHub, potentially exposing them to unauthorised access. Detecting and highlighting these types of vulnerabilities, SonarCloud helps developers proactively address security concerns and strengthen the overall security of their applications.

All in all, having a powerful tool such as SonarCloud integrated into your CICD pipeline is essential to maintaining and improving the standard of DevSecOps you implement on every project.