SonarCloud Security Audit Skill

This skill fetches all security-related issues (vulnerabilities and security hotspots) from SonarCloud for all repositories under the NASA PDS organization and exports them to a CSV file for security triage.

Prerequisites

• •Node.js v18 or higher
• •SonarCloud API token with read access to nasa-pds organization

How It Works

1. •Authenticate: Uses SonarCloud API token (from SONARCLOUD_TOKEN environment variable or prompts user)
2. •Fetch Projects: Queries /api/projects/search?organization=nasa-pds to get all repositories
3. •Query Vulnerabilities: For each project, calls /api/issues/search with types=VULNERABILITY
4. •Query Hotspots: For each project, calls /api/hotspots/search
5. •Export CSV: Combines results into a CSV file with triage columns

Execution Steps

Step 1: Check for API Token

Check if SONARCLOUD_TOKEN environment variable is set:

env | grep SONARCLOUD_TOKEN

If not set, prompt the user:

• •"A SonarCloud API token is required to access the NASA PDS organization."
• •"You can generate a token at: https://sonarcloud.io/account/security"
• •"Please set the SONARCLOUD_TOKEN environment variable or provide it when prompted."

Step 2: Run the Fetch Script

Execute the main script:

cd sonarcloud-security-audit
node scripts/fetch-security-issues.mjs nasa-pds [output-file.csv]

Parameters:

• •nasa-pds (required): Organization key
• •output-file.csv (optional): Output file path (default: sonarcloud-security-issues-{timestamp}.csv)

The script handles:

• •Pagination for large result sets (SonarCloud API returns max 500 items per page)
• •Rate limiting (429 responses)
• •Authentication errors (401)
• •Network failures with retry logic

Step 3: Review Output

The CSV will contain these columns:

• •Project: Repository/project key
• •Type: VULNERABILITY or SECURITY_HOTSPOT
• •Severity: BLOCKER, CRITICAL, MAJOR, MINOR, INFO (vulnerabilities only)
• •Status: OPEN, CONFIRMED, RESOLVED, REOPENED, CLOSED
• •Rule: SonarCloud rule ID (e.g., javascript:S4426)
• •Message: Issue description
• •Component: File path
• •Line: Line number (if applicable)
• •Created: ISO 8601 timestamp
• •URL: Direct link to issue in SonarCloud UI

Step 4: Present Results

After successful execution:

1. •Display count summary: Found X vulnerabilities and Y security hotspots across Z projects
2. •Show output file path
3. •Provide quick triage suggestions:
   • •Sort by severity (BLOCKER/CRITICAL first)
   • •Filter by status (focus on OPEN/CONFIRMED)
   • •Group by rule for bulk remediation

CSV Output Format

Project,Type,Severity,Status,Rule,Message,Component,Line,Created,URL
pds-api,VULNERABILITY,CRITICAL,OPEN,java:S4426,Use a secure cipher...,src/main/Security.java,45,2025-01-15T10:30:00Z,https://sonarcloud.io/...
pds-registry,SECURITY_HOTSPOT,,TO_REVIEW,java:S2092,Cookie should be HttpOnly,src/auth/Cookie.java,23,2025-01-10T09:15:00Z,https://sonarcloud.io/...

Error Handling

Authentication Failures (401)

• •Verify token is valid and not expired
• •Check token has read permissions for nasa-pds organization
• •Regenerate token at https://sonarcloud.io/account/security

Rate Limiting (429)

• •Script automatically waits 60 seconds before retrying
• •Reduce concurrent requests if persistent

No Results

• •Verify organization key is correct (nasa-pds)
• •Check if projects exist: https://sonarcloud.io/organizations/nasa-pds/projects
• •Confirm projects have been analyzed (no analysis = no issues)

Advanced Options

Filter by Severity

Modify script to filter vulnerabilities by severity:

const severities = ['BLOCKER', 'CRITICAL']; // Only high severity

Filter by Status

Include only actionable issues:

const statuses = ['OPEN', 'CONFIRMED', 'REOPENED'];

Date Range

Filter issues created after a specific date:

const createdAfter = '2025-01-01'; // YYYY-MM-DD format

SonarCloud API Reference

• •Projects Search: GET /api/projects/search?organization={org}
• •Issues Search: GET /api/issues/search?organization={org}&componentKeys={project}&types=VULNERABILITY
• •Hotspots Search: GET /api/hotspots/search?organization={org}&projectKey={project}

All requests require: Authorization: Bearer {token}

Base URL: https://sonarcloud.io/api

Troubleshooting

"Organization not found"

• •Verify organization key: nasa-pds (case-sensitive)
• •Check access permissions

Empty CSV

• •Projects may not have security issues (good news!)
• •Verify projects are analyzed in SonarCloud
• •Check if token has correct organization scope

Timeout errors

• •NASA PDS has many repositories; script may take 5-10 minutes
• •Monitor progress output to track completion

Notes

• •Security hotspots do NOT have severity levels (they require manual review to determine if they're actual vulnerabilities)
• •The Status field for hotspots uses different values: TO_REVIEW, REVIEWED, ACKNOWLEDGED
• •URLs link directly to SonarCloud UI for detailed analysis and remediation guidance
• •CSV can be imported into spreadsheet tools, Jira, or other triage systems