SonarQube Integration

Align's SonarQube™ integration brings each project's quality gate, measures and issues into Align, for your workspace's staff. It works with a self-hosted SonarQube Community Build or with SonarQube Cloud. It is an Align Official app in the Marketplace: a workspace admin installs it, connects it with a SonarQube token, and binds each Align project to the SonarQube project that holds its code.

Align mostly reads from SonarQube. It writes there only to create the webhooks it can create for you, and, if an admin asks for managed setup, to create a project and its analysis token.

What it does

• Quality snapshots. For each bound project, Align keeps the quality gate (passed or failing, and which conditions fail), the key measures (reliability, security and maintainability issues, coverage, duplications, size), and the latest analysis with its date and version. On SonarQube Cloud's Team and Enterprise plans it also keeps the ten newest branches and the ten newest pull requests. A snapshot is updated when SonarQube's webhook says an analysis finished, when Align checks on its own about once an hour, and when someone clicks Refresh.
• Code quality card. The project page's Overview shows a Code quality card: the gate, its failing conditions, the measures with their new-code changes, the last analysis, and links to SonarQube and to the project's SonarQube issues. On Cloud it has a picker for branches and pull requests.
• Release check. A release's page has a Quality gate panel, and the release checks include the gate when a release is marked shipped. A failing gate warns; it blocks only where the project opts in. See The release check.
• Issues on demand. The SonarQube issues page lists the bound project's issues. Staff can make an entry from one issue, make entries from a selection, or link issues to an entry that exists. An entry shows the SonarQube issues linked to it.
• Suggestions. After each analysis, Align can post the new Blocker and High findings as an internal note on the related entries, and as a comment on the related GitHub pull request. Nothing becomes an entry until someone creates it. See Suggestions.
• Max and MCP. Max, Align's assistant, and the MCP tool get_code_quality answer questions such as "is this release's quality gate green?" from what Align stored. See Max and MCP.
• Managed setup. For a project linked to a GitHub repository, Align can create the SonarQube project, its webhook and the binding, and open a pull request that adds the scan workflow. See Managed setup.

Who sees what

SonarQube data is for your workspace's staff: admins, managers, developers, testers, tech leads, product owners and DevOps engineers. It is decided by the role a person holds in the project's workspace, not by any role they hold elsewhere.

Clients, portal users and viewers see nothing from SonarQube in Align: no card, no panel, no issues, no notes, no Max answers and not the project's SonarQube settings, and client portal links carry nothing. The Public API never returns those settings, and the webhook event for a finished analysis goes only to webhook subscriptions your workspace created, never to an app installed from the Marketplace. (A pull request comment, if you turn those on, is on GitHub; see Suggestions.) There is one exception, so that nobody is blocked without being told: if a failing gate stops a release from being marked shipped, someone who isn't staff is told only "A check that only this workspace's staff can see is failing. Ask them about it."

Who	What they can do
Workspace admins	Install and uninstall the app, connect and disconnect it, rotate the webhook secret (or Generate a new secret beside a project's manual webhook steps), choose a SonarQube project to bind, and run managed setup.
Admins and managers	Unbind a project, click Set up webhook again on a bound project, and change the project settings SonarQube quality gate can block and Suggest SonarQube findings.
All staff who can open the project	See the card, the release panel, the issues and the bound project's webhook status, click Refresh, make entries from issues and link them, and use the suggestions on an entry.

Editions

	SonarQube Community Build	SonarQube Cloud, EU	SonarQube Cloud, US
Where	Your own server, at a public https:// address	sonarcloud.io	sonarqube.us
Plan or version	Version 24.12 or later	Any plan	A Team (annual) or Enterprise plan, per Sonar
What you enter	The server's address	The organization key	The organization key
Branches and pull requests	Main branch only; no branch or pull request analysis	Main branch only on the Free plan, with pull requests into main; all branches and pull requests on Team and Enterprise	Branches and pull requests
Live updates (webhooks)	Yes	Team and Enterprise only. The Free plan has none, so Align's hourly check is the only refresh.	Yes

• Community Build must answer on a public https:// address. Align refuses plain http://, private and internal addresses, and it never follows a redirect, so enter the address the server finally answers on. A server on a private network can't be reached.
• SonarQube Cloud tokens and organizations belong to one region. A token made on sonarcloud.io does not work on sonarqube.us, and the other way round. Choose the region you sign in to.

The token

Align reads SonarQube with one token per workspace. Where you can, create it for a dedicated SonarQube user that has only the permissions below, so that the token can do no more than Align needs.

• Community Build: a user token (My Account → Security), not a project or global analysis token.
• SonarQube Cloud: a personal access token of a member of your organization. Scoped organization tokens have not been checked with Align yet, so use a personal access token for now.

The least permission depends on what you want Align to do:

What you want	What the token's user needs
Read quality gates, measures and issues (read-only)	Browse on each project Align should read. On Community Build, public projects need nothing.
Align creates each project's webhook for you	Administer on each project as well. Without it, you add the webhook yourself; see The webhook and its secret.
Managed setup	The global Create Projects permission. The new project's creator must also get Administer on it, which SonarQube's default permission template normally gives to "Project Creators". Making the project's analysis token also needs Execute Analysis.

A read-only token works for everything except managed setup, which Align then never offers.

If the token has an expiry date, the Code quality card warns 14 days before it expires. Put a new token in with Edit before then.

Connect

You need the Admin role in your Align workspace.

1. Open Marketplace, choose SonarQube, and click Install. Before you confirm, the install dialog says that SonarQube will ask for a SonarQube token, which permission the token needs, and that Align stores it encrypted and never shows it again. When it is installed, the connect wizard opens.
2. Where does your SonarQube run? Choose Self-hosted (Community Build 24.12+) or Cloud.
3. The details and a token.
   • Self-hosted: the Server address, for example https://sonarqube.example.com.
   • Cloud: the Region (EU or US) and the Organization key, as it appears in your organization's address on SonarQube Cloud.
   • The Token.
   • Webhook secret (optional): only if you already sign SonarQube webhooks with a secret of your own. Leave it blank and Align makes one.
4. Click Test connection to check the details without saving them, then Save. If the test fails, the wizard says why; see Troubleshooting.
5. The last step says what comes next: bind your projects. When you bind an Align project to a SonarQube project, Align adds the webhook to that SonarQube project for you, using this connection's token. There is nothing to do in SonarQube.
6. Bind your projects; see Bind a project.

If Align made the webhook secret, the last step also has a closed section, Set up a webhook by hand instead (only if Align can't). Open it only if you are adding a webhook yourself, for example because the token can't administer your projects. It says where the webhook goes (on Community Build, the project's Project Settings → Webhooks; on Cloud, the organization's Administration → Webhooks), to name it "Align", and shows the Receiver URL and the Webhook secret, each with a Copy button. Align shows that secret only this once. You can make a new one later; see Generate a new secret.

Later, the SonarQube row in Settings → Integrations (under Developer Tooling) shows the connection, with Edit, Test, Rotate webhook secret, Disconnect and Uninstall in Marketplace. The Connection button on the app's Marketplace page opens the wizard again.

The server, region and organization are fixed once a token is saved. This stops a stored token from being sent somewhere else. To change them, enter a new token for the new server, region or organization in the same save, or disconnect and connect again.

The token is stored encrypted (AES-256-GCM) and is never shown again. To replace it, type a new one; leave the field blank to keep the stored one.

The webhook and its secret

When an analysis finishes, SonarQube can tell Align at once through a webhook. Each connection has one receiver URL on Align and one webhook secret. SonarQube signs every delivery with the secret, and Align refuses any delivery that isn't signed with it.

When you bind a project, Align adds the webhook to that SonarQube project if the token may administer it. Otherwise the binding panel shows the steps to add it yourself, for as long as the project is bound:

1. In SonarQube, open the project.
2. On Community Build, go to Project Settings → Webhooks; on SonarQube Cloud, go to Administration → Webhooks. Choose Create.
3. Name it "Align" and paste the receiver URL the panel shows.
4. For the secret, use Generate a new secret in Align and paste it here.

Align never shows a secret a second time, so the steps don't ask for the one shown when SonarQube was connected. If you'd rather Align add the webhook, give the token's user Administer on the project and click Set up webhook again.

SonarQube never retries a delivery that fails, so Align also checks every bound project about once an hour. Without a webhook, quality still updates, only later.

Generate a new secret

Beside the manual steps in a project's SonarQube — code quality panel, workspace admins have Generate a new secret. After you confirm, Align makes a new secret and shows it once, with a Copy button, next to the receiver URL and the steps. It is the same as rotating the secret: the connection has one secret, so Align gives the new one to every webhook it created or found, and a webhook someone added by hand in another project must be given the new secret too. Leaving or reloading the page clears it, and Align never shows it again.

Rotating the secret

On the SonarQube row in Settings → Integrations, click Rotate webhook secret and confirm. Align makes a new secret, shows it once, and gives it to every webhook it created or found in SonarQube. It lists which webhooks it updated and any it could not.

A webhook you made by hand keeps the old secret, and Align refuses its deliveries until you paste the new secret into it in SonarQube. Align's hourly check carries on meanwhile.

Bind a project

A binding says which SonarQube project holds an Align project's code.

1. Open Settings → Projects, open the project, and go to the Integrations tab.
2. In SonarQube — code quality, search for the SonarQube project by name or key, and click Bind.
3. The panel says what happened to the webhook:
   • Live updates on: Align created the webhook, or found one already pointing at Align.
   • Add the webhook in SonarQube: the token can't administer the project. Follow the steps shown; see The webhook and its secret.
   • No live updates on this plan: SonarQube Cloud's Free plan has no webhooks. Align refreshes the project about once an hour.
   • Webhook not set up: the reason is shown. The project is bound anyway.

Align reads the project's quality straight after binding.

The panel keeps showing the webhook's status for as long as the project is bound, so you can come back to it later. It is the outcome of the last time Align set the webhook up: at the bind, after a reconnect, or after Set up webhook again. Staff see it; clients, viewers and portal users don't.

• Set up webhook again appears for Add the webhook in SonarQube, No live updates on this plan and Webhook not set up. Admins and managers can use it, as they can bind. Align tries again with the connection's token, exactly as a bind does, and the status changes in place. It doesn't rebind the project or reset its results. For example, give the token's user Administer on the project, then click it: the status becomes Live updates on, with one "Align" webhook in SonarQube.

• Generate a new secret appears beside the manual steps, for workspace admins; see Generate a new secret.

• Only workspace admins can choose the project, because listing SonarQube projects uses the workspace's token. Managers can unbind.

• In one workspace, an Align project binds to one SonarQube project, and a SonarQube project binds to one Align project.

• The list shows the projects the token can browse. If SonarQube cut the list short (it returns at most 10,000 results), search for the key and choose Bind to the key.

• Unbind stops the updates. The project's results are kept, marked out of date, and Align deletes the webhook it created for that project. A webhook you made by hand stays.

Managed setup

For a project linked to a GitHub repository, an admin can have Align set up SonarQube for it. It is optional: binding an existing SonarQube project works as before.

Admins find Set up code quality in the project's SonarQube — code quality panel. Align offers it only when:

• the token may create projects (see The token);
• the project is linked to a GitHub repository, through a GitHub account connected in this workspace;
• SonarQube's permission template doesn't refuse the project's creator Administer. Align usually can't read the template, so it checks right after creating the project instead.

Otherwise the panel says why not. Other staff see a setup's progress once an admin has started one.

It runs these steps, and stops at the first one that needs something:

1. Create the SonarQube project. It is created private, keyed owner_repository (or the key the project is already bound to), with the repository's default branch as its main branch. A project that already exists and that this workspace may bind is used instead.
2. Confirm Align can administer it. If it can't, the step says exactly what a SonarQube admin should change.
3. Register the webhook and bind the project, as binding does.
4. Open a pull request with the scan workflow. On a branch named align/sonarqube-setup, it adds sonar-project.properties and .github/workflows/sonarqube.yml. The workflow runs once a day, can be run by hand from the repository's Actions tab, and never fails a build: if SONAR_TOKEN is missing, it skips with a warning.
5. Set the SONAR_TOKEN repository secret. On Community Build, Align makes an analysis token for this one project and puts it straight into the repository secret. Align never stores or shows the token.
6. Receive the first analysis. Nothing runs until you merge the pull request.

GitHub permissions. The automatic path needs Align's GitHub App to have Contents, Workflows, Secrets and Pull requests, all read and write. If any is missing, Align still creates, checks and binds the SonarQube project, then shows the two files and the secret for you to add yourself.

SonarQube Cloud. Align offers managed setup on Cloud only if SonarQube Cloud confirms the token may create projects in the organization. Cloud has no analysis token for one project that Align could make, so you add SONAR_TOKEN yourself.

Resume. Click Resume setup to carry on from the first step that isn't done. A run that stopped part-way, for example because Align restarted, shows Needs attention and can be resumed.

Rotate analysis token. On Community Build, for a project Align set up automatically, Rotate analysis token makes a new token, revokes the old one, and replaces the repository secret.

A setup finishes where it began. Align refuses to resume it when:

• the project was bound to a different SonarQube project since. Unbind it to let the setup bind its own project again, or leave the setup as it is to keep the new binding;
• the project is linked to a different repository since. Link the first repository again, then resume, or start over. Align changes nothing in either repository.

Start over. An admin can click Start over on any setup that isn't running. Align deletes the setup's progress and revokes the analysis token it set as SONAR_TOKEN, so scans in that repository stop until a setup runs again. It keeps the SonarQube project, the project's binding to it (and its webhook) and any pull request it opened, and deletes nothing in SonarQube or GitHub; the confirmation says exactly what stays. The next run starts from the first step, in the repository the project is linked to then.

Align revokes the token only through the SonarQube connection that made it. If SonarQube won't revoke it, or your workspace has since been disconnected or connected again (to the same server or another one), Align deletes nothing and names the token and the server it lives on. Revoke it there by hand (in SonarQube, signed in as the user Align's token belonged to: My Account → Security), then click Start over without revoking the token. Align then forgets the setup, and the token stays live until someone revokes it; the audit log records that you went ahead.

The release check

When a project is bound, its release checks include the SonarQube quality gate. See also Release checks.

• A failing gate is a warning by default: "Quality gate failing in project: conditions."
• To make it block, turn on SonarQube quality gate can block in the project's settings (Settings tab, beside Release checks). It blocks only when the project's release checks are also set to Block. A workspace admin can override it with a written reason, as for any blocking item, and the override is audited.
• An out-of-date or missing analysis is a softer warning and never blocks. Out of date means Align couldn't keep the result current: the project was unbound or disconnected, the last refresh failed, Align has heard nothing for over a day, or Forward Rise has paused SonarQube. The warning says "No SonarQube analysis since date" and why.
• Which analysis counts. The main branch's latest analysis. Align records no branch on a release, so this is main on SonarQube Cloud too. If the analysis's sonar.projectVersion matches the release's Version (ignoring a leading v and letter case), the panel says so; otherwise it names the analysis it used. Set sonar.projectVersion to your release version in your scan if you want the match.
• A project with no binding, or a workspace without a SonarQube connection, has no quality gate item at all.

Suggestions

After each analysis, Align can suggest the new Blocker and High findings (Blocker and Critical on a server in Standard Experience mode) where your team will see them. The project setting Suggest SonarQube findings, under the binding on the project's Integrations tab, decides what Align posts:

Setting	What happens after an analysis
Off	Nothing is posted.
Entry notes (the default)	An internal note on each related entry, with the findings grouped by rule and folder.
Entry notes and PR comments	The notes, plus one comment on the related GitHub pull request, updated after each analysis. Skipped where SonarQube Cloud already comments on the pull request itself.

• Nothing is created automatically. On the entry, the SonarQube suggestions panel lists each suggested group with Create entry and Link to this entry.
• Related entries. For a pull request analysis: the entry the pull request names in its title or branch. For a branch analysis: the entries of the pull requests merged into that branch since SonarQube's previous analysis of it. A branch's first analysis has nothing to compare with, so it suggests nothing.
• No repeats. A finding is suggested once per project, and never once it is linked to an entry. A note is written only when there is something new: a new finding, or a gate that changed.
• Limits. A note lists at most 8 groups, and 5 places per group. Align writes at most 12 notes per project per hour.
• The note is an internal note, so clients never see it in Align. A pull request comment is on GitHub, so anyone who can read the repository sees it; choose Entry notes if that is not what you want. Comments go only through the GitHub account connected in this workspace.

Issues

From the Code quality card, click Issues to open the SonarQube issues page. Filter by severity, quality, status, rule and new code (on Cloud, by branch or pull request), then:

• Create entry on one issue makes one entry;
• Create entries (one per rule per folder) on a selection makes one entry for each rule in each folder, listing every place;
• Link… or Link to entry… links issues to an entry you name by number.

The entry's type follows the finding: a security finding (a vulnerability) becomes a Security entry, a reliability finding (a bug) a Bug report, and a maintainability finding (a code smell) a Task. Its priority follows the severity: Blocker is critical, High is high, Medium is medium, and Low and Info are low. A server in Standard Experience mode names the middle severities Critical, Major and Minor; they count as High, Medium and Low.

An entry's SonarQube issues block shows the issues linked to it, with their last-known status. Refresh reads their status from SonarQube again.

Max and MCP

Max (code_quality.get) and the MCP tool get_code_quality answer from what Align last stored: a project's quality gate and failing conditions, its measures and last analysis, a release's gate, or the SonarQube issues linked to an entry. For a release they give the release check's own answer, the one the release page shows: the same state, the same analysis and version match, the same day-long rule for an out-of-date analysis, and whether it stops the release being marked shipped. They never send anything to SonarQube. Only staff can use them. See Max and MCP Integration.

Paused by Forward Rise

Forward Rise can pause the SonarQube app for every workspace, for example while a problem with it is fixed. While it is paused:

• Align sends nothing to SonarQube: no hourly check, no Refresh, no suggestions, and no connect, test, bind, Set up webhook again, new webhook secret or managed setup. A bound project's webhook status still shows.
• Align refuses SonarQube's webhook deliveries. SonarQube shows them as failed in the project's webhook history; that is expected.
• The Code quality card, the release's Quality gate panel, the binding panel and the SonarQube row in Settings → Integrations say Paused by Forward Rise. The last results Align read still show, marked out of date.
• The quality gate is a softer warning in release checks and never blocks, even where the project lets a failing gate block.
• Nothing is uninstalled, disconnected or deleted. Your connection, token, bindings and webhooks stay as they are.

When Forward Rise lifts the pause, everything resumes by itself, and Align's next hourly check brings the results up to date. You can still disconnect or uninstall while the app is paused; Align can't delete its webhooks then, and says which ones to delete by hand.

Uninstalling and disconnecting

Disconnect (on the SonarQube row in Settings → Integrations) keeps the app installed. Uninstall (from Marketplace → Installed Apps → SonarQube, under Danger Zone) removes it. Both do the same clean-up first:

1. Align deletes the webhooks it created in SonarQube. Webhooks you made by hand stay; delete them in SonarQube.
2. Every project's results are kept and marked out of date.
3. The connection and its stored token are deleted. An uninstall also cancels the installation.

If Align can't delete a webhook it created (SonarQube is down, the token was revoked, or the app is paused), it disconnects anyway and then lists each SonarQube project whose webhook is left. Open each of those projects in SonarQube and delete the webhook named "Align": Project Settings → Webhooks on Community Build, Administration → Webhooks on SonarQube Cloud.

Project bindings are kept. If you install and connect again, the bindings come back, and the new connection has a new receiver URL and webhook secret. When the new connection first passes its test (on save, or on a later Test if the first save failed), Align sets up each bound project's webhook again at the new address, and the wizard lists how each one went. Update any webhook you made by hand with the new receiver URL and secret.

Troubleshooting

Testing or saving the connection

The wizard and Test show a headline and Align's own sentence. They never show what SonarQube's server sent back.

Headline	What it means	What to do
Some details are missing or not valid	The edition, region, organization key or server address is missing or malformed, or a Cloud connection has a server address.	Fill in the fields for your edition only.
Align connects over https only	The address starts with http://.	Use the server's https:// address.
Align can't connect to that address	The address is private, local or internal, or (Cloud) outside the region's own hosts.	Use a public address. Servers on a private network aren't supported.
No token yet	No token is stored.	Enter a token.
SonarQube isn't installed in this workspace	The Marketplace install is missing, cancelled or on hold.	Install SonarQube from the Marketplace, then connect.
SonarQube didn't accept the token	The token was refused.	Check it was copied whole, hasn't expired or been revoked, and (Community Build) is a user token.
The token and organization look like they're in the other region	Cloud refused the token and has no organization by that key in this region.	Choose the other region, or check the organization key and make a new token.
Organization not found	Cloud accepted the token but can't show that organization to it.	Check the organization key, and that the token's user is a member.
The server answered with a redirect	Align doesn't follow redirects.	Enter the address the server finally answers on.
Align couldn't reach the server	DNS, TLS, connection or a 10-second timeout.	Check the address, and that the server is reachable from the internet over https.
That address doesn't answer like SonarQube	The answer wasn't SonarQube's.	Check the address points at SonarQube itself.
This SonarQube version is too old	Community Build older than 24.12.	Update the server, then test again.

"Connected" with "This token can't see any of its projects yet" (Cloud) means the token works but its user has no Browse on any project.

Results out of date or a refresh failed

The Code quality card says when its results are out of date, and why:

What the card says	Why	What to do
SonarQube was disconnected in this workspace	The connection was removed.	Connect SonarQube again.
This project was unbound from the SonarQube project	The binding was removed or changed.	Bind the project again if you want updates.
Align couldn't refresh these results	The last refresh failed. The card shows the reason; see below.	As the reason says.
Paused by Forward Rise	Forward Rise has paused the SonarQube app.	Nothing; it resumes when the pause is lifted. See Paused by Forward Rise.

The reasons a refresh fails:

The reason says	What to do
… did not accept this connection's token	The token expired or was revoked. Enter a new one with Edit, then Test.
… did not let this connection's token read the project	Give the token's user Browse on the project.
… has no project that this connection's token can see	The SonarQube project was deleted or renamed. Bind the Align project again.
… is limiting Align's requests (HTTP 429), or answered HTTP 5xx	SonarQube is busy. Align waits (5 minutes, doubling up to 6 hours, or as long as SonarQube asks) and tries again by itself.
… did not answer within 10 seconds, or Align could not reach …	The server was unreachable. Align tries again later.
… answered with a redirect	Align doesn't follow redirects. Check the server address.
This SonarQube connection has no token	Enter a token with Edit.

Refresh answers "refreshed moments ago" if someone refreshed the project in the last minute, and "SonarQube asked Align to wait" while Align is waiting after a 429 or 5xx.

Binding

What you see	What to do
"That SonarQube project is already bound to another project in this workspace."	Unbind it from the other project first.
"… is not among the SonarQube projects this connection's token can browse"	Give the token's user Browse on that project, or pick one from the list.
"… already has as many webhooks as SonarQube allows (10)."	Remove a webhook from the SonarQube project, then click Set up webhook again.
"This binding changed while it was being saved."	Reload and try again.

Webhooks not arriving

• After rotating the secret, or generating a new one: a webhook made by hand still has the old secret. Paste the new one into it.
• After disconnecting or reinstalling: the receiver URL changed. Align sets up the webhooks it can again when you connect; update a hand-made webhook, or bind the project again.
• While the app is paused by Forward Rise: Align refuses deliveries on purpose. They resume when the pause is lifted.
• On SonarQube Cloud's Free plan: there are no webhooks. Align refreshes about once an hour.
• In every case, Align's hourly check still picks up new analyses, only later.

Managed setup

What you see	What to do
Not offered: the token is read-only	Give the token's user the global Create Projects permission, or bind an existing project.
Not offered: the project has no repository, or its GitHub account isn't connected here	Link the repository to the project, and connect its GitHub account in Settings → Integrations → GitHub.
The files and secret are shown instead of a pull request	Align's GitHub App lacks Contents, Workflows, Secrets or Pull requests (read and write). Accept the new permissions on GitHub, or add the files yourself.
Confirm Align can administer it needs a change	Ask a SonarQube admin to give "Project Creators" Administer in the default permission template, or give the token's user Administer on the project, then Resume setup.
"This project is now bound to the SonarQube project …"	The project was bound to another SonarQube project since the setup began. Unbind it to finish the setup, or leave the setup as it is.
"This setup began in … and the project is now linked to …"	Link the first repository again, then resume. Or click Start over to set it up in the repository the project is linked to now.
Needs attention: the last run stopped before it finished	Click Resume setup.

Support

Questions or issues: support@alignsoft.us. We aim to respond within one business day.

Changelog

• 2026-11 — Initial release: Community Build and SonarQube Cloud (EU and US), quality snapshots and the project card, the quality gate as a release check, issues to entries on demand, suggestions on entries and pull requests, managed setup, and read-only answers in Max and MCP.

---

SonarQube is a registered trademark of SonarSource SA. Align is not a SonarSource product.