

SonarQube and Harness compete in the software development lifecycle, focusing on code quality and automation processes. Harness has the upper hand due to its advanced features and perceived value by technical teams.
Features: SonarQube offers strengths in code analysis with support for multiple programming languages, customizable quality profiles, and integration with CI/CD pipelines. Harness stands out with its automation capabilities in deployment pipelines, AI-driven error suggestions, and various deployment strategies.
Room for Improvement: SonarQube could enhance setup simplicity, expand integration capabilities, and improve security vulnerability detection. Harness may benefit from refining initial configuration, reducing manual intervention, and enhancing support for custom application settings.
Ease of Deployment and Customer Service: Harness provides seamless deployment with strong lifecycle management and responsive support. SonarQube requires more extensive initial setup, though it offers straightforward deployment processes and active community support.
Pricing and ROI: SonarQube is cost-effective with lower initial setup costs, appealing to those focusing on code quality. Harness, with a higher initial cost, offers substantial ROI through CI/CD pipeline efficiency, justifying the investment for organizations seeking comprehensive automation solutions.
By adopting templates and various different pipelines across our own IDP platform, we have saved upwards of 30 to 40% of development time.
Time is saved because we now save engineering time. Before, it required two to three engineers actively monitoring production during deployments, but after starting to use Harness, there is zero or minimal manual monitoring.
With Harness, the release process decreased from three or four hours to one or two hours, making deployments much quicker.
It is easily integrable with the CI/CD pipeline and supports multiple projects with its extensive plugin options.
I have seen a return on the investment from SonarQube Server (formerly SonarQube) because the value it adds relates to static code analysis and vulnerability assessments needed for our FDA approval process.
We see productivity increasing based on the fact that the code review is mostly automated, allowing the developer to fix the code themselves before assigning it to someone else to review, thus receiving that ROI.
We have rarely faced issues with Harness tech support.
Harness customer support is really helpful anytime I try to reach out; they are available to assist with any issues I am facing.
We have been receiving incident reports whenever an incident occurs on Harness, and they are usually quick to respond.
The community support is quite effective.
The customer service and support for SonarQube Cloud are responsive and helpful.
Integrating it into different solutions is straightforward.
Our entire organization uses it with hundreds of applications, and it supports this scale effectively.
It is able to work on our infrastructure side, which is EKS, and we are able to handle our organization growth effectively for an enterprise use case.
When I integrated Harness to more than 20 applications in one place, it becomes less stable.
There are limitations, and it seems to have fewer capabilities than Veracode.
It has been used in multiple projects and performs well.
I would rate the scalability of SonarQube Server as a 10 because we can configure the server to scan multiple projects based on the number of lines.
We have rarely faced issues with Harness tech support.
Harness is decently stable.
I think SonarQube Server (formerly SonarQube) is stable, and we did not face any problems unless there was a power outage or if the LAN cable was plugged out.
From my team's feedback, it is almost an eight out of ten.
It is a quite stable solution.
There is not a lot of good support for pipeline as code, and I often find myself not using pipeline as code the way other platforms such as GitHub Actions or Jenkins integrate pipeline as code.
An improvement idea is better guided onboarding with more opinionated defaults and examples.
Previously, when deploying a version that had been deployed successfully before, it sometimes failed upon trying again, which seems to be an intermittent issue about stability.
I would like to see SonarQube Cloud provide more detailed solutions for fixing code issues, especially solutions related to CVEs.
I need a solution that can bring together three key areas: vulnerabilities, static scanning, and misarchitecture.
Static code analysis is good, but the product lacks dynamic code scanning capabilities, an area where Veracode excels.
From what I understand with respect to Harness, licensing and setup costs were relatively low for an enterprise, and the pricing was more catered toward enterprises who would invest in the technology.
I would rate the pricing for SonarQube Server (formerly SonarQube) as an 8, where 1 is very cheap and 10 is very expensive, because Coverity is very expensive, and while SonarQube is not cheap, it is still less expensive than Coverity.
They always offer around a two-year contract, but we always take a one-year contract because it's expensive.
The freemium version of SonarQube Server offers excellent value, especially compared to the high costs of Snyk.
Harness uses AI to suggest errors in case of deployment failures.
Meantime to recovery (MTTR) improved from 30 to 60 minutes before Harness to 5 to 10 minutes now.
The best features in Harness are its user-friendliness and setup configuration.
Some of the static code analysis capabilities are the most beneficial.
I find SonarQube Cloud very easy to use and simple to integrate initially.
It gives precise reports compared to Coverity and has a slightly lower number of false positives.
| Product | Market Share (%) |
|---|---|
| SonarQube | 18.8% |
| Harness | 0.6% |
| Other | 80.6% |
| Company Size | Count |
|---|---|
| Large Enterprise | 7 |
| Company Size | Count |
|---|---|
| Small Business | 41 |
| Midsize Enterprise | 24 |
| Large Enterprise | 79 |
Harness offers a comprehensive toolset for automating deployment processes and enhancing software update efficiency. It's lauded for its CI/CD capabilities, feature flagging, and real-time deployment monitoring. Key features include an intuitive UI, secret management, and robust rollback functionalities, all contributing to improved productivity and reduced errors in DevOps environments.
SonarQube provides comprehensive support for multi-language development, custom coding rules, and quality gates, integrated seamlessly into CI/CD pipelines. It empowers teams with clear insights through intuitive dashboards, identifying vulnerabilities, code smells, and technical debt.
SonarQube is renowned for its extensive capabilities in static code analysis, making it an invaluable tool for maintaining code quality. By fully integrating into development processes, it allows organizations to manage vulnerabilities and ensure compliance with coding standards. Its extensive community and open-source roots contribute to its accessibility, while robust dashboards facilitate code quality monitoring. Despite its strengths, feedback suggests enhancing analysis speed, better integration with DevOps tools, and refining the user interface. Users also point to the need for handling false positives effectively and expanding on AI-based features for dynamic code analysis.
What are SonarQube's main features?In industries like finance and healthcare, SonarQube aids in obtaining regulatory compliance through rigorous code quality assessments. It is implemented to enhance cybersecurity by identifying potential vulnerabilities, while ensuring code meets the stringent standards demanded in these fields. As part of a broader development ecosystem, its integration in CI/CD pipelines ensures smooth and efficient software delivery, catering to phases from code inception to deployment, effectively supporting large-scale and critical software applications.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.