Sonar SCA

Sonar SCA is the software composition analysis component of SonarQube Advanced Security, scanning third-party dependencies for known vulnerabilities and license issues alongside code quality and SAST. Its AI CodeFix feature uses LLMs to suggest one-click remediations for both first-party code and dependency upgrades. The unified platform lets advanced SAST trace data flow into third-party libraries to find vulnerabilities traditional SCA tools miss.