The generated SQL uses single quotes around the table name (FROM 'EURUSD'), which in SQL denotes a string literal, not an identifier. This will produce invalid SQL (or query the wrong thing). Use an unquoted identifier or proper identifier quoting (typically double quotes), and ensure symbols are validated/escaped to avoid SQL injection via symbols[i].

getBaseQuery returns an empty string when symbols is empty, but streamPriceData will still execute the query string it gets back. Returning an empty query can lead to runtime SQL errors; consider returning an empty result early in streamPriceData (or throwing) when symbols is empty.

If localtime_r fails, the code logs an error but then continues to call std::strftime using an uninitialized tm value. This can print garbage timestamps. Consider continue; (or otherwise handling the error) after the failure so the formatting code is skipped.

This CMake file links OpenMP::OpenMP_CXX unconditionally, but find_package(OpenMP REQUIRED) is only called inside if(APPLE). On non-Apple platforms this will fail because the imported target won’t exist. Consider calling find_package(OpenMP REQUIRED) for all platforms (keeping only the Apple-specific hints in the if(APPLE) block) or conditionally linking OpenMP when found.

This script is missing a shebang (e.g., #!/bin/bash or #!/usr/bin/env bash). As-is, running it directly (instead of sh scripts/build_dep.sh) may fail depending on permissions/default shell. Add a shebang and consider set -euo pipefail so dependency builds fail fast.

tradeManager is retrieved but never used (all example calls are commented). This will trigger unused-variable warnings and adds dead code. Either remove it for now or implement the intended trade-management flow so Operations::run has a concrete effect.

Inside the tick loop, expensive timestamp formatting work is done for every tick even though the output is commented out. This will significantly slow large backtests; remove this work or gate it behind a debug flag / only sample a small number of ticks.

If localtime_r fails, the code logs an error but still calls strftime on tm, which can produce misleading output; consider continue on failure. Also rename time_t to avoid shadowing the time_t type name.

This CMakeLists globally appends -w//w, which disables warnings for all targets (including your own code) and can mask real issues. Prefer limiting warning suppression to third-party targets only (e.g., via per-target compile options or SYSTEM includes).

The Ubuntu Sonar job runs sh ./scripts/build.sh, but that script relies on macOS tooling (Homebrew + xcrun) and is expected to fail on Ubuntu. Replace this with Linux-compatible build steps (apt deps + cmake) or make scripts/build.sh OS-aware.

file(GLOB_RECURSE SOURCES "source/*.cpp") inside source/CMakeLists.txt will look for source/source/*.cpp relative to this CMakeLists, which is likely not intended and can produce an empty library. Use paths relative to the correct root (e.g., "*.cpp" if this file is the project root) or switch to explicit target sources to avoid fragile globs.

symbols[i] is concatenated directly into the SQL string (including the FROM clause), so a malicious or malformed symbol can inject SQL or break the query. Validate symbols against an allowlist and/or implement safe identifier escaping rather than raw string concatenation.

fastParseTimestamp uses shared mutable function-local static cache state. If streamQuery is called concurrently, this is a data race (UB). Consider making the cache thread_local or moving it into a caller-owned object.

This script always passes -DCMAKE_OSX_SYSROOT=$(xcrun --show-sdk-path) to CMake; xcrun won’t exist on Linux, and this script is invoked from the Ubuntu Sonar job. Guard the xcrun call or only pass CMAKE_OSX_SYSROOT on Apple platforms.

LAST_MONTHS is provided by the decoded configuration but this call hard-codes 3, so the CLI config is ignored. Use config.LAST_MONTHS (with validation) so backtests match the provided config.