SonarQube "Security Hotspots Reviewed" below 100% in CI

By Kaveh Alemi·Latchkey

The default gate requires 100% of security hotspots on new code to be reviewed. A hotspot is not a confirmed issue; it needs a human to mark it Safe or Fixed. Until then, the gate fails.

What this error means

The gate reports "Security Hotspots Reviewed on New Code" below 100%, for example "0.0% (required is 100%)", even when there are no bugs or vulnerabilities.

QUALITY GATE STATUS: FAILED
  0.0% Security Hotspots Reviewed on New Code (required is 100%)

Common causes

New hotspots have not been reviewed by a human

Sonar flagged code that touches security-sensitive APIs. Hotspots require manual review to be marked Safe or Fixed; unreviewed ones fail the gate.

Reviewing happens on the server, not in the scan

The scanner cannot mark hotspots reviewed. Someone must open the Security Hotspots tab and act on each one.

How to fix it

Review each new hotspot on the dashboard

1. Open the Security Hotspots tab for the project or pull request.
2. For each hotspot, read the risk description and mark it Safe, Acknowledged, or Fixed with a comment.
3. Re-check the gate; once all new hotspots are reviewed the condition passes.

Fix hotspots that are real risks

If a hotspot is a genuine problem (for example an unsafe subprocess call or a hardcoded secret), change the code, then mark it Fixed.

How to prevent it

• Review new security hotspots as part of code review.
• Educate reviewers that hotspots need an explicit decision, not just a fix.
• Keep the gate at 100% reviewed so security-sensitive code always gets a look.

Frequently asked questions

Related guides

References

• GitHub Actions documentation