Does sonarqube community edition provide any sort of static application security testing

Question

We use sonarqube community edition and though it workes great for static code analysis, i don't see anything much significant when it comes to security analysis. It does flag security vulnerabilities and provides security reports for OWASP Top 10 and SANS Top 25. I am wondering if that is part of some static application security testing or we need to go with developer/enterprise editions for fully fledged end to end SAST. Please clarify.

Answer 1

You get security vulnerability and hotspot scanning with the community edition. But for specific analysis, you need to get the paid versions. Here's a comparison of security-related features in those versions.

Source: https://www.sonarqube.org/downloads/