Security Assessment for SonarQube™ Cloud

With support for OWASP Top 10, CWE Top 25, and OWASP ASVS, this solution generates PDF reports showing the critical vulnerabilities of your SonarQube™ Cloud (SonarCloud™) projects, helping you comply with the most important security standards.

This command-line application provides predefined PDF reports that offer clear, executive-level information about the security status of your code.

OWASP Top 10 PDF Report for SonarQube™ Cloud

The OWASP Top 10 lists the ten most critical security risks for web applications, helping developers and organizations protect their projects. Maintained by OWASP, a leader in software security.

This solution allows exporting reports for OWASP Top 10 2025 (default), OWASP Top 10 2021, and OWASP Top 10 2017 directly to PDF.

CWE Top 25 PDF Report: Prioritize Critical Weaknesses

CWE Top 25 provides a common language to identify and prioritize the most critical software weaknesses, enabling better risk prevention and mitigation. Maintained by MITRE Corporation.

bitegarden Security Assessment for SonarCloud™ supports PDF generation for CWE Top 25 2025, 2024, 2023, 2022, 2021, 2020, and 2019, plus the corresponding "On the Cusp" weaknesses for every one of those years.

OWASP ASVS PDF Report: Verify Your Application Security

OWASP ASVS defines security tests for architects, developers, and testers, helping ensure secure applications.

Security Assessment for SonarQube™ Cloud (SonarCloud™) allows generating PDFs with complete OWASP ASVS information.

bitegarden Security Assessment for SonarCloud™ supports PDF generation for OWASP ASVS, including version 5.0.0 (latest, default) and version 4.0.3.

ISO 5055 PDF Report: Evaluate Reliability and Security

ISO/IEC 5055:2021 measures the internal structure of software across Security, Reliability, Performance, and Maintainability, determining system robustness and reliability.

The tool supports PDF generation according to the ISO/IEC 5055:2021 standard.

bitegarden Security Assessment for SonarQube™ Cloud (SonarCloud) supports PDF generation for ISO/IEC 5055:2021.

DISA STIG PDF Report: Harden Applications to DoD Standards

The DISA Application Security and Development (ASD) STIG defines a comprehensive set of security controls required for software used by the U.S. Department of Defense, helping teams harden their applications against common attack vectors.

bitegarden Security Assessment for SonarCloud™ supports PDF generation for STIG ASD V6 and STIG ASD V5R3.

CWE-KEV PDF Report: Known Exploited Vulnerabilities

CWE-KEV cross-references the CISA Known Exploited Vulnerabilities (KEV) catalog with CWE weaknesses, helping teams prioritize the issues that attackers are actively exploiting in the wild.

bitegarden Security Assessment for SonarCloud™ supports PDF generation for CWE-KEV 2025 and CWE-KEV 2023.

Try Buy

Looking for PDF report generation for SonarQube™ Server? Check out bitegarden Security Plugin for SonarQube™ Server.

Main features include:

- Java Command Line Tool that can be used standalone or integrated into your CI/CD tool as a step to automatically generate the report.

- SonarCloud™ OWASP Top 10 in PDF to verify your code against the standard, including all the security metrics vulnerabilities.

- SonarCloud™ CWE Top 25 in PDF to verify your code against the CWE Top 25 Most Dangerous Software Weaknesses.

- SonarCloud™ OWASP ASVS in PDF to verify your code against the Application Security Verification Standard.

- SonarCloud™ ISO/IEC 5055 in PDF to evaluate reliability, performance, and maintainability.

- SonarCloud™ DISA STIG in PDF to harden your applications to U.S. Department of Defense standards.

- SonarCloud™ CWE-KEV in PDF to prioritize actively exploited vulnerabilities.

PDF generation includes additional customizations:

- Support for branches: generate PDF reports for any of your project branches.
- Support for pull requests: generate PDF reports for a specific pull request instead of a branch.
- Support for all SonarCloud™ languages and technologies.
- Support for custom footer logo to add your organization logo.
- Support for english and spanish reports.

bitegarden Security Report for SonarCloud™ requires Java 17 or later.

How to generate PDF security reports for projects in SonarCloud™

Here you have a quick usage guide to generate PDF security reports from SonarCloud™.

Once you have downloaded the product you will have an auto executable "jar" file.

Just put it anywhere in your filesystem and run the jar with --help option to see all the available options:

java -jar bitegarden-sonarcloud-security.jar --help

You will get something like this:

...
Mandatory properties:

                      sonar.token = your user security token to authenticate against SonarCloud.
                                    It is recommended to generate a new token for this app.
                 sonar.projectKey = the project key from SonarCloud. You can find it in SonarCloud project information
            sonar.organizationKey = the SonarCloud organization the project belongs to

          Optional properties:

                      report.type = owasp-top-10-2025 (default value)
                                    owasp-top-10-2021
                                    owasp-top-10-2017
                                    cwe-top-25-2025
                                    cwe-top-25-2024
                                    cwe-top-25-2023
                                    cwe-top-25-2022
                                    cwe-top-25-2021
                                    cwe-top-25-2020
                                    cwe-top-25-2019
                                    cwe-on-the-cusp-2025
                                    cwe-on-the-cusp-2024
                                    cwe-on-the-cusp-2023
                                    cwe-on-the-cusp-2022
                                    cwe-on-the-cusp-2021
                                    cwe-on-the-cusp-2020
                                    cwe-on-the-cusp-2019
                                    owasp-asvs    (latest version, currently 5.0.0)
                                    owasp-asvs-v5
                                    owasp-asvs-v4
                                    iso-5055
                                    stig-asd-v6
                                    stig-asd-v5r3
                                    cwe-kev-2025
                                    cwe-kev-2023

                     sonar.branch = the branch where we will get the information for the report (default is main branch)
                sonar.pullRequest = the pull request key to analyze instead of a branch (mutually exclusive with sonar.branch)
                       footer.url = URL of the image to display centered in footer (PNG or JPG format are supported)
                      user.locale = Locale to use for generated PDF file. Options are English (user.locale=en) or Spanish (user.locale=es)
                           output = File name for the generated report
            report.optional.label = Extra optional label (To display optional label, its required optional value too, else, it won't be rendered)
            report.optional.value = Description for the optional value
disable.iso5055.not.supported.cwe = If you want to show Not Supported CWE, change that option to false (default is true)

...

All the properties should be passed to the command line app using Java system properties with "-D" or using a custom properties file.

If you use a custom properties file you should run the application with the "config.file" parameter and provide the path to the properties file:

java -Dconfig.file=myreportconfig.properties -jar bitegarden-sonarcloud-security.jar

If you just want to pass the required parameters through system properties use "-D" arguments when running the report:

java -Dsonar.token=mytoken -Dsonar.projectKey=myprojectkey -Dsonar.organizationKey=myorg -Dreport.type=cwe-top-25-2021 -jar bitegarden-sonarcloud-security.jar

If a property is defined in both locations (file and command line args) the command line property will override the property in the file. This way you can have a generic configuration file with the common properties (sonar.token, sonar.organizationKey, report.type, ...) and then use command line args for specific properties like sonar.projectKey or sonar.branch.

java -Dconfig.file=myreportconfig.properties -Dlicense.file=PATH_TO_LICENSE_FILE -jar bitegarden-sonarcloud-security.jar