The layer your code scans don’t seeYou already verify the code you write and the dependencies you import in SonarQube. The images you ship add another layer: operating system packages, language runtimes and libraries that never appear in your repository. Teams often check that layer in a separate tool and end up with a second set of findings to reconcile.

Read the full article at Sonar →