How SonarQube A, B C,D and E Rating Calculated?

Question

On Project Dashbord you see below on different attributes.

"D" Security Rating on New Code is worse than A

"C" Reliability Rating on New Code is worse than A

Do we have measure criteria documented ?

Answer 1

Documented? Why, yes. Yes they are: https://docs.sonarqube.org/display/SONAR/Metric+Definitions

Specifically, Security and Reliability ratings are based on the severity of the worst open issue in that domain:

• E - Blocker
• D - Critical
• C - Major
• B - Minor
• A - Info or no open issues

For Maintainability the rating is based on the ratio of the size of the code base to the estimated time to fix all open Maintainability issues:

• <=5% of the time that has already gone into the application, the rating is A
• between 6 to 10% the rating is a B
• between 11 to 20% the rating is a C
• between 21 to 50% the rating is a D
• anything over 50% is an E

The size of the code base is calculated by the number of lines where

The value of the cost to develop a line of code is 0.06 days.