Browser-local AppSec gate · Source checked August 29, 2026

Does Hunter Agent add evidence your current layers miss?

Check current access, code scope, seeded logic cases, SAST and pentest boundaries, finding validation, root-cause remediation, operations, and measured incremental value.

Quick answer

Use Hunter Agent as one code-verification layer. A credible evaluation proves unique valid findings against seeded cases, preserves SAST/SCA and external testing, and turns each accepted result into an independently verified fix and deterministic regression.

Verification evidence

Check only evidence for the exact Cloud org, project, code snapshot, and evaluation corpus. Selections stay in this page and are not saved.

Local result

Define the missing evidence

Eight gates remain. Begin with one code snapshot, seeded logic flaws, paired negative controls, and the current security layers used for comparison.

A passing checklist does not certify vulnerability coverage, finding accuracy, exploitability, severity, compliance, or application security.

Continue by evidence layer

GA and accessVerify Cloud, Server, scan, scope, and workflow boundaries. Layer comparisonPlace SAST, SCA, Hunter, tests, review, and pentesting. Logic-flaw corpusBuild access, workflow, auth, session, and negative cases.

Hunter Agent readiness questions

No. It runs locally in the browser and does not connect to SonarQube, a repository, CI, an account, or source code. Do not paste credentials, code, findings, contracts, or security records into this page.
Not at the August 29, 2026 source check. Sonar announced general availability for SonarQube Cloud and described Server support as coming soon.
No. Sonar positions it as a complement to SAST. External penetration testing and other layers still cover deployed configuration, runtime behavior, infrastructure, integrations, and attack chains.
No. Independently verify the affected asset, reachable path, exploitability, impact, severity, root-cause fix, regression, deployment, and closure decision.
Run a bounded non-production evaluation with seeded positives and negative controls, compare it with existing layers, review every result, and expand only if AppSec and engineering owners accept the incremental evidence and operating cost.

Official references: Sonar GA announcement and Hunter Agent product page.