Tool
SonarQube Cloud is a hosted static-analysis platform from Sonar that scans software projects for bugs, security vulnerabilities, secrets, and other code-quality issues, then presents findings in a project dashboard. In the demonstrated workflow, it follows user-controlled data into database execution to identify a SQL-injection vulnerability, provides guidance for fixing it, and verifies the edited code after the fix replaces string interpolation with a parameterized query. The workflow can be connected to coding agents through Sonar's CLI, plugin, hooks, skills, and MCP server so that context, issue listings, secrets checks, and verification run within the coding loop.
2 uses taken from transcripts — each links to the moment in the video.
Static analysis platform that scans the Python project, flags the planted vulnerabilities on a dashboard, and provides the guide/verify/solve workflow.
Dashboard where scans are triggered, issues are reviewed, triaged and assigned; also available self-hosted as SonarQube Server
2 in the library.