SonarQube API endpoints reachable without login on default configuration
Observed exposure While reviewing a SonarQube deployment, I noticed that several REST endpoints—such as /api/system/status , /api/components/search , and /api/measures/tree —respond with JSON data without any credentials. My understanding is that this is the documented default behavior, since sonar.forceAuthentication (available since 6.7) ships disabled. De
sonarqube