Skip to main content
TrustRadius
SonarQube

SonarQube

Overview

What is SonarQube?

SonarQube is a code quality and vulnerability solution for development teams that integrates with CI/CD pipelines to ensure the software you produce is secure, reliable, and maintainable.

Read more
Recent Reviews

TrustRadius Insights

SonarQube has proven to be invaluable for software engineering companies looking to ensure code quality and prevent the release of faulty …
Continue reading
Read all reviews

Awards

Products that are considered exceptional by their customers based on a variety of criteria win TrustRadius awards. Learn more about the types of TrustRadius awards to make the best purchase decision. More about TrustRadius Awards

Return to navigation

Pricing

View all pricing

Community

Free

On Premise

Developer EDITION

Starts at $160

On Premise
per year per installation

Enterprise EDITION

Starts at $21,000

On Premise
per year per installation

Entry-level set up fee?

  • No setup fee
For the latest information on pricing, visithttps://www.sonarsource.com/plans-and…

Offerings

  • Free Trial
  • Free/Freemium Version
  • Premium Consulting/Integration Services

Starting price (does not include set up fee)

  • $160 per year per installation
Return to navigation

Product Demos

Understanding Issues with Multiple Locations

YouTube

SonarQube analysis with Jenkins

YouTube

GitHub: Block the Merge of a Pull Requests

YouTube
Return to navigation

Product Details

What is SonarQube?

SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating with DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of the release pipeline, displaying pass/fail results for new code based on quality profiles that can be customized to a company's standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production. At its core, SonarQube includes a static code analyzer that identifies bugs, security vulnerabilities, hidden secrets, and code smells. The platform guides the user through issue resolution, fostering a culture of continuous improvement. SonarQube’s reporting helps dev teams to monitor their codebase's overall health and quality across multiple projects in their portfolio. UltimatelySonarQube aims to enable users to achieve a state of Clean Code, leading to secure, reliable, and maintainable software.

SonarQube Screenshots

Screenshot of Application Status.Screenshot of Portfolio Overview.Screenshot of Taint Analysis.

SonarQube Technical Details

Deployment TypesOn-premise, Software as a Service (SaaS), Cloud, or Web-Based
Operating SystemsWindows, Linux, Mac, Cloud
Mobile ApplicationNo
Supported CountriesGlobal
Supported LanguagesCommunity localization plugins support several languages.

Frequently Asked Questions

SonarQube is a code quality and vulnerability solution for development teams that integrates with CI/CD pipelines to ensure the software you produce is secure, reliable, and maintainable.

SonarQube starts at $160.

Veracode, Checkmarx, and Fugue, part of Snyk are common alternatives for SonarQube.

The most common users of SonarQube are from Enterprises (1,001+ employees).
Return to navigation

Comparisons

View all alternatives
Return to navigation

Reviews and Ratings

(87)

Community Insights

TrustRadius Insights are summaries of user sentiment data from TrustRadius reviews and, when necessary, 3rd-party data sources. Have feedback on this content? Let us know!

SonarQube has proven to be invaluable for software engineering companies looking to ensure code quality and prevent the release of faulty software. Users have utilized SonarQube for a wide range of use cases, including generating code quality reports, detecting bugs, vulnerabilities, and code smells, and analyzing code coverage for JUnit tests. The software serves as a static application security tool, helping to identify and fix security issues and vulnerabilities in code. It is seamlessly integrated into Azure DevOps Continuous Integration pipelines, providing detailed issue descriptions and code highlights to identify vulnerabilities. With its comprehensive analysis of the codebase, SonarQube helps in enforcing good practices and preventing bugs, serving as a quality gate for software development. By utilizing static code analysis, SonarQube helps developers create bug-free code and detect vulnerabilities early on, saving valuable time in the development process. Additionally, SonarQube aids in maintaining code quality, improving coding structure, and ensuring code reliability and security. Beyond these primary use cases, users have found value in using SonarQube to check code coverage, follow coding suggestions, manage technical debt, monitor unit test coverage for C++ projects, track bugs and code quality while the security team focuses on vulnerability scanning, and adhere to industry standards. Its customization options allow users to tailor the rules to their specific needs and enable toll-gating to prevent bad code from reaching production. The plugin-based framework of SonarQube ensures extensibility for new use cases and has been highly regarded by users who find it easy to integrate with existing tools and infrastructure. Whether it's identifying design flaws before committing or merging code or tracking legacy code issues and offering solutions for improvement, SonarQube plays a crucial role in improving the overall quality of software development projects across various industries.

Efficient and Precise Code Quality Reports: Multiple users have praised SonarQube for its highly efficient and precise code quality reports. This feature has allowed them to gain a comprehensive understanding of their code's quality, identify areas for improvement, and enhance the overall quality of their code.

Detection of Bugs and Vulnerabilities: Reviewers have found SonarQube's ability to highlight bugs and vulnerabilities in the codebase to be a valuable asset. This feature has helped them identify potential issues early on, enabling them to take proactive measures to improve the code's quality and security.

Valuable Code Remediation Suggestions: Many users have expressed appreciation for SonarQube's suggestions for code remediation and resolution. These suggestions have proven extremely valuable in helping them make their code cleaner, more maintainable, and ultimately improving long-term code quality.

Tricky Importing of Custom Quality Profile: Reviewers have found that importing a new custom quality profile on SonarQube can be challenging and tricky, causing frustration during the setup process.

Inconvenient Server Restart Requirement: Some users have reported the inconvenience of having to restart the server every second time in order to rerun it, which disrupts their workflow and wastes time.

Slow Report Generation and Updating: Several reviewers have mentioned that generating a new report on SonarQube takes a significant amount of time. Additionally, they have experienced delays in updating the details of the new report, as it continues to display information from previous reports instead.

Based on user feedback, here are the most common recommendations for using SonarQube:

Consider using SonarQube if your team size is above 10. For smaller groups, it is recommended to use the community version or integrate Sonarlint with IDE for free.

Integrate SonarQube with CI servers like Cloudbees and Jenkins, as well as version control and testing tools like UFT. This will make the development process smoother and more efficient.

Leverage SonarQube's features, such as code coverage analysis, testing, and code health monitoring. Users find these features valuable for understanding code conventions, maintaining code quality, and identifying security issues or code smells in applications.

Attribute Ratings

Reviews

(1-25 of 34)
Companies can't remove reviews or game the system. Here's why
Score 10 out of 10
Vetted Review
Verified User
Incentivized
We use SonarQube to analyze our codebase, the main goals are detection of code smells, security vulnerabilities, and performance issues, also to measure our test coverage. It is part of the continuous integration process. We perform analysis in different languages like Java, JavaScript, Typescript, and Python. We are planning to include new ones, like scala and PHP.
  • Code complexity detection
  • Code smell detection
  • Provides good default rules
  • Huge language support
  • Easy setup
  • Easy integration with common build tools
  • Great fix proposals, and issues description
  • It doesn't provide automatic pull request with fixes
  • It doesn't provide insights about the libraries of the projects
  • The administration management user interface could be simplified
  • It doesn't provide an order to fix issues, like archives with more and frequent commits have top priority
- The SonarQube analysis provides good suggestions to improve our project's health
- The default rules "Sonar Way" are pretty good and provide good insights
- I consider it a mandatory tool for any serious project.
- You can use offline tools like error-prone, spotbugs, or PMD, but Sonar analysis is more complete and it has more features.
February 03, 2023

Code Quality is a Must!

Ariel Cabeza | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
Incentivized
We use SonarQube as part of the CICD pipeline running on Azure DevOps. Mostly .Net projects, and currently integrating with react native.
  • Ongoing code quality management
  • Increase developer skills.
  • Detect and report problems.
  • Scale with business needs
  • Optimize the quality
  • it is sustainable
  • The main “disadvantage” is code maintenance, being more expensive, it also takes more time, as well as producing “false positives”.
SonarQube allows automatic static analysis of source code, looking for patterns with errors, bad practices or incidents.
In addition, it performs a calculation of the technical debt. It can be used in any scenario.
In order to use SonarQube, you need to install a server component, where the engine that performs the analysis and stores the results is located, and the analysis must be invoked in some way, which can be done with a client called SonarQube Scanner.
You can also integrate the analysis into the IDE you are using, with a plugin called SonarLint!.
Score 9 out of 10
Vetted Review
Verified User
Incentivized
SonarQube is the default choice for static analysis tools for all the projects in our organization. We use it extensively for examining code quality, detect code smells, detect security issues in code and identify complexities in code for every project. SonarQube is extremely useful since it works for almost all languages that we write our code in, including python and Java. The plugin based framework ensures extensibility and easy enhancement of functionality for new usecases.
  • Easy integration with all coding languages
  • Plugin integration ensures easy extensibility
  • Detects code smells and vulnerabilities
  • Generate test coverage reports
  • Custom quality gates to ensure no bad code is merged
  • Learning curve is steep
  • Report generation is often very time consuming
  • Works particularly well for Java, but not so good for Python and R
  • Initial setup is quite complicated
You should buy: If you need static analysis for multiple languages in your teams If static analysis integration with IDEs is an important requirement If you need custom quality gates for code quality analysis If highly detailed test coverage reports is important for your organization Do not buy if you cannot afford a dedicated team to manage the SonarQube instance for your organization
Sérgio Cagica | TrustRadius Reviewer
Score 8 out of 10
Vetted Review
Verified User
Incentivized
It's used as a quality gate for software development in the feature implementation, as well as a security barrier for bugs and good practices enforcer.
  • Easily setup quality gate for code analysis and tests.
  • Quick reports for vulnerabilities and good practices.
  • Easy setup of vulnerabilities level requirements.
  • Credentials manager, like managing users, groups and permissions is complex.
  • UI for code review can be improved, feels old but is useful nonetheless.
  • The ticket management system can also be improved.
Sonarqube does its job properly, it can improve in some points like usability and user experience, but in the end, it does everything you need well.
Sayam Jain | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
Incentivized
We are a product based Company where we are using SonarQube to keep an eye on the Code quality of our all the projects. It really reduced the workload of the reviewers and helped a lot to improved our code quality and efficiency of the project. It helped us a lot where we can define our own set of rules in all the languages. It has helped us to identify the static code which reduced our deployment efforts.
  • You can set your own rules for almost all the languages
  • Most of the rules are already defined you just need to use them
  • It helps us on Security aspects too.
  • you can place a gate on Code coverage too.
  • UI part of reporting needs more improvement.
  • Simple tooltips can be there for the users to understand better instead of reading documents.
  • For report extraction in Excel or Pdf you need Enterprise version
As we were having multiple projects in multiple languages to support our product, A team of 20 developers was working with the various level of experience. To maintain the code integrity and its Sanity SonarQube helped a lot to place the quality gates, Some of the rules were pre-defined and required very minor tweaking. It really made life easy for the reviewers as it supports multiple integration with gitlab, confluence and Jenkins.
Aman Makwana | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User
Incentivized
As service based and product based organisation we are dealing with variety of products and projects so in order to maintain the Code Quality and also improve the coding structure by following the suggestions given by SonarQube Analysis and also checking the Code Coverage so we get to know that our code has fully passed through the Sonar Analysis. As a part of DevOps team we integrate SonarQube checks in CI(continuous integration part) so its an part of continuous code quality and we have also created custom Quality Gates in order to prevent the false or unimproved code from going into any environments.
  • Static Code Scanning
  • Code Coverage reports, User Friendly Dashboard
  • Integration with various tools in order to maintain code quality
  • Pre-built as well as Custom Quality Gates
  • Detect Bugs & Vulnerabilities, Review Security Hotspots, Track Code Smells
  • Also has many plugins to interact with
  • As in SonarQube community edition they should enable the after scanning report generation
  • other security reports like, vulnerability with preferred solution
  • Guide on scalability, backups, resiliency as well
  • small report type UI on other tools as well like Jenkins
When we have a big projects/products and also there are multiple tech stacks involved in project and also there's an dedicated team working of multiple tech stack is working so there we need to ensure the uniformity in coding structures and also its has support for many languages out there in market. Its not suitable for small projects where the user base, internet traffic is not much. because in that use case we have more headache on maintaining SonarQube servers
Score 8 out of 10
Vetted Review
Verified User
Incentivized
SonarQube is a freeware used for checking security vulnerabilities, inspection of automatic code quality checks and for CI/CD automation. In our organization we used this application as an integrated service plugin with Microsoft Azure's DevOps for CI/CD automation. It is very helpful application for inspection of applications developed using a variety of programming languages.
  • Automatic code analysis
  • Checking Security vulnerabilities
  • Easy integration with devops applications
  • Need more examples for different programming language codes
  • Better documentation
Well suited:
- Easy to Integrate with different DevOps platforms for CI/CD automation
- To detect application security vulnerabilities
- For automation static code checks / analysis in order to detect bugs
- Can be used for variety of programming language applications
Improvement areas:
- Better documentation
- More programming language specific examples
Score 7 out of 10
Vetted Review
Verified User
We use SonarQube in the software department in our devOps pipeline to analyze source code for our application and provide metrics on issues that it identifies within the codebase. Basically we'll run SonarQube at various steps of code check ins and merges as one of many metricsto determine code quality and alert the teams to potential issues in recently checked in codde that may need to be triaged and addressed.
  • Works well with .Net
  • Has a nice extension that allows us to run it in our IDE (visual studio)
  • Is customizable in the sense that you can write your own rule set that you want SonarQube to analyze the code against
  • Often it finds errors that aren't really errors that have impact, takes a lot of time to sort through those cases
  • It's a good screener, but by no means can it catch all bugs or be the sole predictor of code quality, so the metrics that it provides need to be caveated when reporting to leadership, etc
Overall it's a nice check to incorporate into the devOps pipeline as another sanity check on the code that's being checked in and the codebase in general. It's good as a supplemental tool, but not if an org is looking for a complete view into code quality or security. Basically SonarQube is able to give you some flagged issues to look into and a metric that reflects the number of issues with the code it identifies, but still requires developers to take a second look and adequately triage which of the SonarQube issues are high impact and need to be addressed.
Prashant Chaudhari | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User
Incentivized
We use SonarQube to scan our source code whenever we push changes to github. SonarQube helps in identifying code smells and security issues in the code with detailed explanation and intuitive reports.
  • code analysis
  • code smell detection
  • security issues with code
  • syntax highlighting for different languages
  • Setup steps can be explained a bit better
Using docker, we were able to setup sonarqube and ran our first scan in about a day's time. It was quick to create different projects and linking source code to scan.
It clearly segregates issues under Reliability, Security and Maintainability buckets.
It also suggests solutions to fix issues with the code with up to date standards.
Score 9 out of 10
Vetted Review
Verified User
Incentivized
We use SonarQube and SonarLint to improve our code and locate vulnerabilities. It helps our developers learn best practices and secure our code.
  • Gives advice on coding practices
  • Rates our code over time
  • Highlights worst offending code to make prioritization easier
  • Helps improve our code over time
  • Notifications based on findings needs a lot of work. Options are extremely basic so far.
  • Integration of Dependency Check is very basic and could use some UX love.
  • Making it easier to turn down the noise of problems so teams can focus on the highest priority first without getting bogged down.
SonarQube is best at giving advice over a wide array of languages. It's ability to filter results by many facets is excellent.
Score 9 out of 10
Vetted Review
Verified User
Incentivized
We use SonarQube as a component in our development and continuous integration environment when developing IT systems. The main purpose of our usage is to be able to identify and find bad design choices and mistakes at an early development stage. Developers use it both in their development environment to be able to find things before committing code and also in the CI environment after committing code to a feature branch but before merging it to master branch.
  • Identify bugs in code
  • Identify bad design choices in the code
  • Give suggestions how to solve bad design choices
  • Could provide more configuration templates for suitable warning levels
  • Improved possibility to escalate repeated errors to architects and management
  • Easy way to deactivate a warning in a specific file
SonarQube is excellent if you start using it at the beginning when developing a new system, in this situation you will be able to fix things before they become spread and expensive to correct. It’s a bit less suitable to use on existing code with bad design as it’s usually too expensive to fix everything and only allows you to ensure the situation doesn’t get worse.
Score 8 out of 10
Vetted Review
Verified User
Incentivized
In my company, we started using the SonarCloud (the SaaS version) a couple of years ago, and then quickly switched for the enterprise edition of SonarQube. This edition offered several governance features that were not available in the other types of Sonar subscription.
Since then, we made automated Sonar scanning mandatory for all projects, integrated directly in our CI/CD pipelines
  • Scanning source code for a defined set of quality gates and rules
  • Reporting security issues with static scans
  • Managing portfolios application in the enterprise edition
  • The scanner is a bit heavy and can be rewritten in a lighter language (like Go or rust)
  • Scans can take a bit of time
  • Some languages like C++ are much harder to scan than others
Honestly, a tool like SonarQube should be always used all the time for any project that uses a supported language (there are lots of them)
When developers produce applications and source code, it's easy for them to miss critical quality and security issues in their Pull Requests.
Sonar makes it much easier to detect those kind of issues, and allows the builds to fail if the quality threshold are not respect for some reason.
It's easy for those kind of issues to end up in production if they are not detected early within the CI/CD steps.
Randy Varela | TrustRadius Reviewer
Score 8 out of 10
Vetted Review
Verified User
SonarQube is our primary DevSecOps tool, helping us and our customers to create a secure development program for our applications and changes in infrastructure.

SonarQube is easy to use once installed and recently we've been using the cloud version (SonarCloud) even easier to integrate with our current tools and infrastructure.
  • SAST
  • DEVSECOPS
  • BUGS
  • SECURITY BEST PRACTICES
  • Not easy to install
  • No support on free version
  • Community Support
SonarQube is a good tool for DevSecOps, it has been with us for years, it's free and it's helping on the security pipeline of many popular and critical development nowadays (Apache struts, Brave, ...). SonarQube is community maintained but fairly up-to-date against recent threats also integrates very quick with most of the common DevOps tools such as Jenkins, Azure DevOps and GitHub
Score 8 out of 10
Vetted Review
Verified User
Incentivized
We have been using it for code analysis and identifying the code smell and code threat. We have integrated in our code pipeline. Every push branch has to go through this check by SonarQube and any code smell or threat identified by SonarQube needs to be worked on by the respective developers to pass the pipeline.
  • For finding the code smell
  • For finding the code threat
  • Helping in improving code quality
  • Mandate to follow best practices
  • some code smell identification algo can be improved
  • Best practices should be upto date
SonarQube is the one of best tool to integrate for code pipeline that improves the code quality of developers and making to follow the best practice. It must be integrated with all repositories.
Score 10 out of 10
Vetted Review
Verified User
Incentivized
The main business problem that SonarQube addresses is ensuing our software is of high quality and free of defects. We use SonarQube to identify and fix issues in our code during development and integration before they become a bigger problem, thus reducing the risk of costly bugs and vulnerabilities.

Common use cases for SonarQube include:
  • Identifying and fixing bugs and vulnerabilities in code
  • Improving code readability and maintainability
  • Increasing code coverage and testing
  • Measuring code quality and compliance with industry standards
  • Keeping track of technical debt
  • Detecting bugs and vulnerabilities: SonarQube can identify a wide range of bugs and vulnerabilities in code, such as null pointer exceptions, SQL injection, and cross-site scripting (XSS) attacks. It uses static analysis to analyze the code and identify potential issues, and it can also integrate with dynamic analysis tools to provide even more detailed analysis.
  • Measuring code quality: SonarQube can measure a wide range of code quality metrics, such as cyclomatic complexity, duplicated code, and code coverage. This can help teams understand the quality of their code and identify areas that need improvement.
  • Providing actionable insights: SonarQube provides detailed information about issues in the code, including the file and line number where the issue occurs and the severity of the issue. This makes it easy for developers to understand and address issues in the code.
  • Integrating with other tools: SonarQube can be integrated with a wide range of development tools and programming languages, such as Git, Maven, and Java. This allows teams to use SonarQube in their existing development workflow and take advantage of its powerful code analysis capabilities.
  • Managing technical debt: SonarQube provides metrics and insights on the technical debt on the codebase, enabling teams to better prioritize issues to improve the quality of the code.
  • Compliance with coding standards: SonarQube can check the code against industry standards like OWASP, CWE and more, making sure the code is compliant with security and coding standards.
  • Complexity of setup and configuration: SonarQube can be quite complex to set up and configure, especially for organizations that have a large codebase or use a variety of different programming languages. This can make it difficult for teams to get started with the tool and may require specialized expertise.
  • Limited support for certain languages: While SonarQube supports a wide range of programming languages, it may not have full support for some languages, particularly newer or less common languages. This can limit the tool's usefulness for teams that use these languages.
  • Lack of integration with certain development tools: While SonarQube can be integrated with a wide range of development tools, it may not have integration with certain IDEs or build tools. This can make it difficult for teams to use SonarQube in their existing development workflow.
  • False-positive and False-negative issues: As with any static code analysis tool, SonarQube can generate a number of false positives, where it reports an issue that is not actually a problem, or false negatives, where it fails to report an issue that is actually a problem. This can make it difficult for teams to trust the tool's analysis results and may require manual review.
  • Limited scalability: For large codebase, SonarQube's performance and scalability can be an issue. It may take longer for the analysis to finish and the results may not be as accurate.
  • Limited collaboration capabilities: While SonarQube allows teams to view and track code quality issues, it has limited capabilities to collaborate and discuss those issues.
Scenarios where SonarQube is well suited:
  1. Large codebase: The tool's static analysis capabilities can help teams quickly identify and fix bugs, vulnerabilities, and code smells in large codebases.
  2. Compliance and security: The tool can check the code against industry standards or regulations, such as OWASP and CWE, and identify any issues that need to be addressed.
  3. Agile development: SonarQube can be integrated with CI/CD pipelines allowing teams to continuously monitor and improve code quality throughout the development process.
  4. Teams using multiple languages: Teams that use multiple programming languages can benefit from using SonarQube, as the tool supports a wide range of languages and can be integrated with a variety of development tools.

Scenarios where SonarQube may be less appropriate:
  1. Small codebase: Organizations with a small codebase may not see the full benefits of using SonarQube, as the tool's static analysis capabilities may be overkill for a smaller codebase.
  2. Limited resources: Organizations with limited resources may find it difficult to set up and configure SonarQube, as the tool can be complex and may require specialized expertise.
  3. Limited integration: Organizations that use development tools or IDEs that are not supported by SonarQube may find it difficult to integrate the tool into their existing development workflow.
  4. Limited scalability: Large organizations with millions of lines of code may find SonarQube's performance and scalability to be an issue. It may take longer for the analysis to finish and the results may not be as accurate.
January 18, 2023

Great Code Analysis Tool

Gabriel Freire | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
Incentivized
It's always best to catch bugs and other code issues as soon as possible, especially when people from different teams and time zones touch the same code. While code reviews are obviously still necessary, SonarQube does filter the code seamlessly so that obvious issues are immediately detected and resolved. In some cases, there is customisation required for the general best practice rules and SonarQube accommodates this.
  • Static code analysis
  • Code best practices
  • Quality profile selection
A scenario that is particularly useful is integrating SonarQube into a Github Actions pipeline so that before any new Pull Request is reviewed and/or merged, you know whether the new code is clean of bugs or major issues.
It is also useful to create custom Quality Profiles to educate new developers that join the company.
Score 8 out of 10
Vetted Review
Verified User
Incentivized
We use Sonar in order to ensure our code is secure. We have used it on APIs and on our Frontend. We have also used the Sonar lint for Android. We have a plug in for our Jenkins account which will check our project code coverage etc in Sonar if this fails then our code cannot go live or merged into master
  • Code coverage
  • Shows potential fixes
  • Speed
  • Sometimes the messages can be long and for someone's first time seeing this it can be hard to find what to look for
  • Sometimes potential fixes are not available
  • Documentation on setting up with Jenkins was hard to follow at some parts
I think having SonarQube in your project is a big bonus as it can spot small vulnerabilities that you might not think of. This also will improve your overall skill in coding securely. They also update regularly so that it can spot new vulnerabilities which may not be known. As package updates there can be more vulnerabilities deep in your project that you may not know about
Score 9 out of 10
Vetted Review
Verified User
Incentivized
  • Standardized scanning tools to make sure code doesn't use obvious code smells
  • Enfrocement of standardized naming conventions in code
  • Identification of potentially needlessly complicated code
  • Identify code smells
  • Low level bugs
  • Basic static analysis
  • Reports can take a bit of time
  • Custom rules can be a bit annoying to setup
If you are looking for something that is reasonably simple and validates your code, this is the tool you are looking for. It works well and gives very helpful feedback, especially for more junior devs.
Score 8 out of 10
Vetted Review
Verified User
Incentivized
We are using SonarQube to do static source analysis on our C# projects. This allows us to monitor unit test coverage and discover code smells that have escaped peer review at the merge request phase.
This may not seem to be of the outmost importance, but it has saved us from publishing bogus software to our clients in a number of occasions.
  • Static analysis
  • Code coverage
  • Code smells
  • Configuration management
  • Reporting
  • Rules deactivation flexibility
Whenever you are doing C# based development, you will want to do some static analysis. While Visual Studio comes with some tools, SonarQube is much more advanced and targets more than just C#
There are cases, however, when it is not very suited : when trying to use it on languages that it does not support natively. For instance, we'd love to use it on pascal flavored languages, but without official support, this proved to be impractical.
Score 8 out of 10
Vetted Review
Verified User
Incentivized
We use SonarQube in our project to basically calculate the code quality report mostly, in that report we test for the bugs, vulnerabilities, code smells, code issues, criticals, blockers, major & minor issues, and also calculate the code coverage of junits. We also set the quality profile which contains the rules which we set according to the rules we follow in our project and on that basis, we generate the junit coverage report.

One business problem I mostly faced was that if we had run the server once, and tried to run it again if we closed it, then it does not run and closes automatically. To run the server again we have to restart the system, then only it works, so those issues can be resolved.

The scope of my case is to generate the code quality report for the codebase in our project according to the custom quality profile we add in SonarQube.
  • Generating code quality report
  • Calculates junit coverage of the codebase very efficiently and precisely
  • Highlights the bugs and vulnerabilities in our codebase
  • Informs the user of the improvements which can be done to the code to make it cleaner
  • SonarQube also suggests remediation and resolution of the problems it highlights
  • Importing a new custom quality profile on SonarQube is a bit tricky, it can be made easier
  • Every second time when we want to rerun the server, we have to restart the whole system, otherwise, the server stops and closes automatically
  • When we generate a new report a second time and try to access the report, it shows details of the old report only and takes a lot of time to get updated with the details of the new and fresh report generated
Debobrata Bose | TrustRadius Reviewer
Score 7 out of 10
Vetted Review
Verified User
Incentivized
SonarQube is being used in my organization as an Static Application Security tool which will detect the security issues in code and will try to fix the vulnerabilities that compromises the app. It is being currently used in all the projects in my department.
It being used in our Azure devops Continuous Integration pipeline to identify the vulnerabilities in code and provides detailed issue descriptions and code highlights that explain why your code is at risk.
  • Identify Security Vulnerabilities and highlights the code
  • Highlight suspicious code snippets that developers should review
  • Providing security feedback during code review
  • Identify technical debts in code
  • The community version have some issues, example Integrating with Azure or Single Sign On
  • Automation scripts can be improved. At times you have to configure some of the rules in the detection
  • It takes time to configure and create profiles
SonarQube has a friendly UI that is easy to use and understand. The admin's control panel is very good and It's not really difficult to get through the settings. Its possible to build many rules that apply for each programming language, for example, .NET, and Java. You can easily set up rules and even with the community version. It's a great tool but you have to have a good project plan before being introduced to the tools. I would recommend using the SonarQube open-source version to get used to it before purchasing the license. Before we go with an enterprise product, we have to know the terms and how things are done to run software quality
Daniel Anjos | TrustRadius Reviewer
Score 10 out of 10
Vetted Review
Verified User
Incentivized
SonarQube is used as part of the build process (Continuous Integration and Continuous Delivery) in all Java services to ensure a high quality of code and remove bugs that can be found during static analysis. The whole engineering organisation is using it, and it solves the problem of low quality code reaching to production and causing bugs and incidents due to poor reviews. With Sonar we are able to quickly identify if a new change will introduce issues in Production before it is merged and deployed. It also helps identify issues with legacy code and improve code quality in existing services, by providing solutions to known problems. I would definitively recommend Sonar to any Software Engineering company, either using Java or C++ or any other supported language.
  • Static Code Analysis
  • Security Vulnerabilities Scan
  • Multi software language support
  • Configurable quality gates for PR analysis
  • Better IDE integration and support
  • Easier GitHub actions integration and support
  • Better support and integration for dynamic code analysis during automated tests
There's no other tool in the market that is as reliable and trust worthy than SonarQube for Static Analysis. They are the industry standard for software quality analysis and should be part of any company that requires audits on software quality and vulnerability (like financial institutions). Of course SonarQube doesn't replace application testing and security testing by specialists, but their automated testing should be baseline for any engineers that values their time, by pointing problems automatically before they are reviewed by other specialist, or even released to production. Don't waste your company's most valuable resource (engineer time and attention) and make sure to invest in automated software quality and static code review tools like SonarQube from the start. You will regret having to retroactively fit such tools in your development process.
Score 8 out of 10
Vetted Review
Verified User
Incentivized
We use SonarQube to check and ensure Java code quality as part of our development process. With built in suggestions for coding improvements the rate at which we produce and deploy quality code has been a game changer. Also, it works to train developers continuously helping to adhere to best practices.
  • Easy to Use
  • Code Quality Improvements
  • Code Suggestions
  • Lacks custom rule sets
  • Expensive
  • Smaller / Less active user community
We only use SonarQube for Java development, so this review can't speak to its effectiveness for other programming languages, of which SonarQube has coverage for many. There are a plethora of CI/CD integrations, so chances are you can put in an automated code quality check in your process to squash bugs before they are deployed.
October 14, 2021

SonarQube wins!

Score 8 out of 10
Vetted Review
Verified User
Incentivized
Used across the organization for static code analysis.
  • Static code analysis
  • Code coverage
  • Scan security vulnerability
  • Technical support
  • Better documentation
  • Scan for third party tools
Well suited for code analysis. OWASP top 10 are pretty much covered.NOT suited for third party tools used in code.
Sharique Khan | TrustRadius Reviewer
Score 9 out of 10
Vetted Review
Verified User
Incentivized
SonarQube is the static security code analysis tool used in the organization. It is integrated with Continuous Integration pipelines of multiple product lines including legacy and modern applications. It has been implemented with TeamCity, Azure DevOps and VSTS CI/CD tools. Its purpose is to ensure the builds are of the highest quality and free of security vulnerabilities.
  • Customizable Ruleset
  • Support multiple programming stacks
  • Ease of integration with multiple CI/CD tools
  • Admin Portal could have more usability
  • Enhanced Reporting
  • More live examples and samples
SonarQube is well suited to implement Secure SDLC and incorporate the best secure coding practices. It would ensure adherence to the organization's coding standards and have uniform code across various development teams. It enables early identification and remediation of security flaws in the code
Return to navigation