SonarQube: code-quality evidence, with edition and licence limits.

A potential source of first-party maintainability, reliability and security evidence. No SonarQube scan was performed for Asterpath.

Fictional, not a scanner result. FICTIONAL ILLUSTRATIVE SAMPLE. Asterpath, its product, evidence, findings and measurements are invented. No Asterpath application was inspected and no scanner was executed. These are original GadirLabs illustrations, not native vendor exports.

Availability / export noteActual run status: Not run

What this tool can contribute

Topic	Verified product guidance
Role	Code quality and first-party security analysis. Taint-analysis and reporting depth depend on the edition.
Native reports	High-level PDF and regulatory ZIP reports start in Enterprise; the ZIP can include TXT, CSV and PDF.
Structured data	The documented Web API can expose metrics; exports need actual analysis identity and complete filters/pagination.
SARIF	Operational documentation verifies SARIF import. This pack does not claim a verified native Sonar SARIF export.
Source handling	SonarQube Cloud receives a scan report containing source. A self-managed instance can keep hosting within the approved environment.
Licence	The current SSAL analyser licence restricts external AI use of Program data. Check the exact installed licence and commercial agreement before processing real Sonar outputs with an external agent.

What an actual client export would show

A permitted real export would show the analysed candidate, edition/version, quality profile, scope and exclusions, measures, hotspots/issues and our triage. Native reports stay identifiable as vendor reports; our summaries stay identifiable as GadirLabs analysis.

This is a GadirLabs-authored tool note, not a vendor report, endorsement or claim of account access. No result, pass/fail status or vendor severity is asserted.

Primary sources

Checked 11 September 2026. These optional reference links require internet access; the sample pack itself works offline.