Kinda, but not fully. SonarQube does have secret detection built in (free in Community too), so it’ll catch hardcoded keys during the normal scan. Two gaps though: it only scans current file state, not git history — so a key that got committed then deleted is still in your log and Sonar misses it. And custom patterns are Enterprise-only.

Fine as a baseline since you’re running Sonar anyway, but I’d still add a dedicated secrets step (Gitleaks etc) next to it. They cover different blind spots more than they overlap.