How TD Bank Scaled Code Quality & Security with SonarQube
summary
TD Bank scales SonarQube across thousands of projects to turn it from a developer IDE helper into an enterprise governance platform supporting $2.1 trillion in assets and ~28 million customers. Implementation uses a two-layer SonarQube model (IDE feedback plus server-side CI analysis), enforced quality gates as policy-as-code that cannot be bypassed, PowerBI dashboards that roll up coverage, bugs, vulnerabilities and technical debt, and even mainframe modernization via GitHub Actions and Zowe to include COBOL. Continuous verification and audit trails provide traceable, auditable compliance.
AI-written summary · about
chapters (23)
- 0:00Introduction
- 0:36From Developer Tool to Enterprise Governance Platform
- 0:58Why Code Quality Matters at Enterprise Scale
- 1:13TD Bank Engineering Scale and Software Dependency
- 1:35How Software Powers Every Banking Operation
- 1:52Why Software Bugs Become Operational Risk in Banking
- 2:45Scaling SonarQube Adoption Through Cultural Change
- 3:02Helping Developers Shift Their Mindset on Code Quality
- 3:16From “Sonar Blocks Me” to “Sonar Protects Me”
- 3:29Quality Gates Required in Every CI/CD Pipeline
- 3:48Policy-as-Code Through CI/CD Integration
- 4:01Building a Traceable and Auditable Software Lifecycle
- 4:26Two-Layer SonarQube Implementation Model
- 5:15Developers Using Sonar as a Coding Assistant
- 5:31Shift-Left Development in Practice
- 5:57Security Risks Detected Before Deployment
- 6:30Tracking Test Coverage, Bugs, and Technical Debt
- 6:50Enterprise Code Quality Dashboards with Power BI
- 7:24Leadership Using Engineering Metrics to Guide Investment
- 8:09Continuous Code Verification in the AI Development Era
- 8:30Expanding Code Analysis to Pipelines and Scripts
- 8:49Key Lessons from TD Bank’s SonarQube Journey
- 9:12Code Quality as Enterprise Risk Management
related talks
11mLove Your Security Engineer as Yourself
42mThe Challenge and Solutions to Implement DevSecOps into Large Banks
36mBuilding Trust in Fintech: DevSecOps Strategies at Saxo Bank
48mDevSecOps Transformation at Speed and Scale Using Tekton
42mThe Challenge and Solutions to Implement DevSecOps into Large Banks
32mBuilding Continuous Integration and Feedback
40mNo More ‘Someone Else’s Problem’: Tackling Tech Debt at Scale
35mTackling Silos Through DevOps at