A quality gate is a rule-based checkpoint in a software delivery pipeline. It evaluates code against predefined conditions, such as test coverage, bug counts, security findings, or code complexity, and decides whether the change can progress to the next stage of release. In tools like SonarQube, a failed quality gate can block a merge or deployment until the issues are addressed.
In cyber security, quality gates matter because they turn security policy into an enforceable control. They help teams stop vulnerable or low-quality code before it reaches production, reducing the chance that defects become exploitable attack paths. Defenders use them to enforce thresholds for SAST findings, dependency risks, or insecure patterns, while attackers benefit when organizations skip such checks and ship flawed code faster. A good quality gate is strict enough to catch dangerous changes, but practical enough that developers can still fix problems quickly.