sonarcloud-security-audit

You can export SonarCloud security vulnerabilities and hotspots to a CSV by running the fetch-security-issues script with your organization key and output path, provided the SonarCloud API token environment variable is set.

Yes, you can automate an organization-wide SonarCloud security audit across all repositories using this script, which handles per-project pagination and exports the consolidated security data into a structured CSV file.

You need a SonarCloud API token with read access to fetch security hotspots and vulnerabilities, which the script uses to handle authentication and robustly manage network or authentication errors during the export.

If you hit SonarCloud API rate limits while fetching security issues, the script includes built-in rate-limit handling and pagination logic to ensure all vulnerability and hotspot data across the organization is reliably exported to CSV.

The best way to triage SonarCloud security data is to export all vulnerabilities and hotspots to a structured CSV file, which organizes the security findings across the nasa-pds organization for comprehensive reporting and analysis.