Is your Sonar quality profile well configured to track security issues?