SonarQube: 92,810 title matches on the platform that holds your source code and your pipeline tokens

SonarQube, a code-quality platform, has discovered 92,810 instances where the platform's title appears on its website, documentation, marketplace listings, and community sites. This occurs because the platform stores two types of sensitive information: source code of analyzed projects and credentials used to fetch that code from version control. When SonarQube is accessible on the internet, both sensitive materials become accessible through it.

The platform provides a distinctive title on its projects page, which also appears in documentation, marketplace listings, and community sites. SonarQube stores a personal access token per integration and often a service account credential for the code platform it analyzes. These credentials are usually broadly scoped, as a scan job needs to read every repository in the organization. The analyzed code itself is also stored, meaning that a compromised or exposed instance can leak intellectual property and secrets.

The findings raise concerns about authentication, permissions, and configuration drift on SonarQube instances. Older releases have seen authentication and permission issues, and an internet-facing instance without recent upgrades combines an exposed surface with a known defect. The default configuration in current releases restricts anonymous access, and many organizations run the server behind a reverse proxy with an identity provider.

However, the counts do not establish whether a server is unauthenticated or if anonymous access is enabled. The counts also do not indicate which projects or organizations are behind each match, and no trend can be claimed as no earlier measurement with the same query is being compared.

To mitigate these risks, operators should treat the server as a secrets store and inventory the tokens it holds for version control. They should review permissions on each token, check whether the scanning account needs write access, ensure anonymous access is disabled unless deliberately used, and confirm that project visibility matches repository visibility.

Additionally, they should assess whether the server needs to be reachable from outside the network, as most scanning traffic originates internally. Public reachability is usually a convenience that can be withdrawn.