SonarQube
Connect SonarQube to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect SonarQube to collect vulnerability scanning evidence with automated compliance tests, switched on per workspace.
| Category | Vulnerability Scanning |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| SonarQube's guide | docs.sonarsource.com |
Connect with an API token
-
In SonarQube:
- Sign in to SonarQube as a dedicated user that can access only the projects Safeguard should read (a user token gives all the permissions of the user who issued it).
- SonarQube Server: go to Account menu › My account › Security.
- In the form at the top of the page, enter a token name, select the token type User token, and select an expiration (or No expiration if allowed).
- Select Generate, then copy the token value immediately; when you dismiss the notification you will not be able to retrieve it.
- SonarQube Cloud: open your account menu in the top right corner, select My account › Access Tokens, and generate a personal token there (or use a Scoped Organization Token on the Team plan and above).
Where to find the other values:
- Base URL (optional): For SonarQube Server, the URL of your instance. Leave empty for SonarQube Cloud.
- Organization (optional): SonarQube Cloud only: your organization key, shown in your organization's URL on SonarQube Cloud.
SonarQube shows the secret only once, so copy it before you leave the page.
If an administrator enforces a maximum token lifetime (Enterprise Edition and above), No expiration is not offered. On SonarQube Cloud, tokens without an expiration date are removed after 60 days of inactivity, and the Personal Tokens tab is only available to users signed in with GitHub. User tokens are deleted when the user is deleted. Which project permission the dedicated user needs is not covered by the fetched pages.
Source: docs.sonarsource.com, docs.sonarsource.com, checked 2026-10-07.
The permissions Safeguard needs:
Browse. -
On Compliance › Connectors, open SonarQube, click Connect, choose API token and fill in:
Field What to enter Base URL (optional) Leave blank to use https://sonarcloud.io. API token Required. Stored encrypted and never shown again. Organization (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read SonarQube and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.1 | 4 |
| ISO/IEC 27001 | Automated tests | A.8.8 | 4 |
| HIPAA Security Rule | Automated tests | 164.308(a)(1) | 4 |
| PCI DSS | Automated tests | 6.3.3, 11.3.1 | 4 |
| NIST CSF 2.0 | Automated tests | ID.RA-01, ID.RA-06 | 4 |
These tests are switched on per workspace by the Safeguard team.
Related
- Vulnerability Scanning connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks