Explain the difference between code smells, bugs, and vulnerabilities in SonarQube. How does SonarQube calculate technical debt, and how do you use this information to prioritize remediation efforts?
Quick Answer
Bugs are code that is demonstrably wrong and will cause runtime errors. Vulnerabilities are security weaknesses exploitable by attackers. Code smells are maintainability issues that make code harder to understand/change but don't cause immediate failures. Technical debt is calculated as the estimated time to fix all code smells, measured in developer-days.
Detailed Answer
Issue Categories
SonarQube classifies issues into three categories based on impact: Bugs (reliability issues) are code errors that will likely cause incorrect behavior at runtime - null pointer dereferences, infinite loops, resource leaks, incorrect equality checks. Vulnerabilities (security issues) are weaknesses an attacker could exploit - SQL injection, XSS, hardcoded credentials, insecure cryptography. Code Smells (maintainability issues) are patterns that make code harder to maintain but don't cause immediate failures - overly complex methods, duplicated code, unused variables, poor naming.
Severity Levels
Each issue has a severity: Blocker (definitely a bug that will crash or corrupt data), Critical (high probability of impacting behavior or is a security vulnerability), Major (quality flaw that could lead to developer confusion or future bugs), Minor (style issue or marginal improvement), Info (not yet a problem but good to fix). The Quality Gate can filter on severity to focus on critical issues first.
Technical Debt Calculation
Technical debt is measured as the estimated time to fix all maintainability issues (code smells). Each rule has a 'remediation effort' (e.g., 'Method too complex' = 15 minutes per occurrence). SonarQube sums these across all code smells to produce a total debt figure. The SQALE rating (A-E) represents the debt ratio: debt / development-time-already-spent. Rating A means debt is less than 5% of development time.
Prioritization Strategy
Prioritize: (1) Blocker/Critical vulnerabilities (immediate security risk), (2) Blocker/Critical bugs (causing production issues), (3) Code smells in frequently-changed files (use SonarQube's 'activity' filter to find hotspots), (4) Debt in core business logic (higher business impact than utility code). Use the 'Effort' metric to identify low-effort/high-impact quick wins. Track the technical debt trend over time - the goal is declining debt, not zero debt.