Security hotspots with medium severity

[Cristianrage]

Hello, how are you?

I have found a common behavior in all the sources that I have downloaded from the lifetime api, every component shows this three hotspots in sonarqube:

I was wandering if there is some kind of files included in the download and is not related with the main source of the application.

Can you confirm this?

Thanks in advance.

[duarte-castano]

Hi Cristian, hope you're doing well!

Thanks for raising this — what you're seeing in SonarQube are hotspots, not actual vulnerabilities. These typically show up because static analysis tools like SAST review code out of context, which can lead to false positives.

To clarify, yes — when you download the source code via the LifeTime API, it also includes some platform code alongside your application code. That platform code is what’s triggering these hotspots in your SonarQube scan.