Workshop 3: Securing your code and your supply chain

AI writes code fast, and most of it depends on open source your team never wrote. Every dependency you pull in is a potential entry point, and vulnerabilities can hide in the interactions between your code and the libraries it calls. This third workshop in the series shows you how to secure both your first-party code and the open source it relies on, in one workflow.

You'll start with SonarQube core security: SAST to detect code vulnerabilities early, taint analysis to trace injection risks across files, IaC scanning to secure cloud configurations, and secrets detection to catch exposed credentials, tokens, and keys before they ship. From there, you'll turn on Advanced Security and see how it extends that coverage to the software supply chain. Software Composition Analysis surfaces known vulnerabilities (CVEs) in your dependencies, prioritized by severity and exploitability, and flags malicious packages before they reach your pipeline. Advanced SAST traces data flow into and out of third-party libraries to uncover cross-boundary vulnerabilities that first-party analysis alone would miss.

You'll also work with the governance and compliance features public sector teams depend on: generate a software bill of materials in CycloneDX or SPDX format, apply and enforce license policies, and produce security reports mapped to OWASP Top 10, CWE, PCI DSS, and STIG. You'll set automated security quality gates that stop risky dependencies and confirmed malware from merging.

Walk away with a working SonarQube project scanning both first-party and open source code for risk, and the ability to apply SAST, SCA, advanced SAST, and compliance reporting to your own projects.

Prerequisites:

Participants should use a personal machine with Docker and a personal GitHub account (not a managed or enterprise account).

No prior SonarQube experience is required, though Workshop 1 provides helpful grounding.