

SonarQube and Harness compete in software development tools, focused on code analysis and CI/CD processes, respectively. While SonarQube excels in code analysis accuracy, Harness is seen as superior due to its automation capabilities and valuable integrations.
Features: SonarQube offers precise code quality analysis, vulnerability detection, and extensive language support. Harness provides CI/CD automation, efficient change management, and seamless integration with development workflows.
Room for Improvement: SonarQube could enhance its automation features, streamline its integration process with other tools, and improve its handling of security vulnerabilities. Harness might benefit from lowering initial setup complexity, expanding its language support beyond CI/CD, and providing more comprehensive user training resources.
Ease of Deployment and Customer Service: SonarQube offers a flexible deployment model and reliable customer support, suitable for various environments. Harness provides straightforward SaaS-based deployment and stands out with its responsive service and smooth implementation backed by comprehensive support resources.
Pricing and ROI: SonarQube generally has lower setup costs and offers strong ROI through enhanced code quality. Harness requires a higher initial investment, with efficiencies in automated deployment and operational time savings offsetting costs, supporting quicker release cycles and reduced manual effort.
The AI features that they have and with which we can rewrite the pipeline and troubleshoot issues significantly saved time.
By adopting templates and various different pipelines across our own IDP platform, we have saved upwards of 30 to 40% of development time.
With Harness, the release process decreased from three or four hours to one or two hours, making deployments much quicker.
It is easily integrable with the CI/CD pipeline and supports multiple projects with its extensive plugin options.
I have seen a return on the investment from SonarQube Server (formerly SonarQube) because the value it adds relates to static code analysis and vulnerability assessments needed for our FDA approval process.
We see productivity increasing based on the fact that the code review is mostly automated, allowing the developer to fix the code themselves before assigning it to someone else to review, thus receiving that ROI.
We have rarely faced issues with Harness tech support.
We have not faced any customer support issues, with tickets resolved in less than a four-day SLA.
There was an instance when I faced issues with third-party plugins, and after raising a support ticket, they responded in a few hours with a documentation link that resolved my issue.
The community support is quite effective.
The customer service and support for SonarQube Cloud are responsive and helpful.
Integrating it into different solutions is straightforward.
Our entire organization uses it with hundreds of applications, and it supports this scale effectively.
It is able to work on our infrastructure side, which is EKS, and we are able to handle our organization growth effectively for an enterprise use case.
When I integrated Harness to more than 20 applications in one place, it becomes less stable.
There are limitations, and it seems to have fewer capabilities than Veracode.
It has been used in multiple projects and performs well.
I would rate the scalability of SonarQube Server as a 10 because we can configure the server to scan multiple projects based on the number of lines.
Harness is completely stable, and we are using it in production without facing any stability issues at all.
We have rarely faced issues with Harness tech support.
Harness is decently stable.
I think SonarQube Server (formerly SonarQube) is stable, and we did not face any problems unless there was a power outage or if the LAN cable was plugged out.
SonarQube is stable since we use it consistently; it performs reliably with minimal downtime, analyzing our code within our pipeline as a part of it.
From my team's feedback, it is almost an eight out of ten.
There is not a lot of good support for pipeline as code, and I often find myself not using pipeline as code the way other platforms such as GitHub Actions or Jenkins integrate pipeline as code.
Improved documentation and onboarding tutorials would help accelerate adoption.
Harness can be improved by providing more clarity on the credits it issues for Harness Cloud, as it has a tiered pricing structure involving license and credit costs, which can get confusing.
There is another website called Code Warrior that really takes you through the entire journey, so you can truly understand what the issue is along with some actual coding examples.
An AI feature should be integrated into SonarQube to resolve issues quickly; optimizing scanning performance for very large repositories and providing faster analysis times would enhance the developer experience, especially in large code bases with frequent commits.
I would like to see SonarQube Cloud provide more detailed solutions for fixing code issues, especially solutions related to CVEs.
From what I understand with respect to Harness, licensing and setup costs were relatively low for an enterprise, and the pricing was more catered toward enterprises who would invest in the technology.
The licensing cost is a little bit too high.
I would rate the pricing for SonarQube Server (formerly SonarQube) as an 8, where 1 is very cheap and 10 is very expensive, because Coverity is very expensive, and while SonarQube is not cheap, it is still less expensive than Coverity.
They always offer around a two-year contract, but we always take a one-year contract because it's expensive.
The freemium version of SonarQube Server offers excellent value, especially compared to the high costs of Snyk.
Harness uses AI to suggest errors in case of deployment failures.
The platform also supports cloud-native environments and Kubernetes deployments, making pipeline management easier, and its automation capabilities significantly improve speed and reliability.
If something goes wrong, I can use AI troubleshooting to build or test my fails and analyze the logs, suggesting the fixes.
Now they have the capability of software composition analysis, which is a win-win situation and a great advantage because under one umbrella, you can get multiple scanning capabilities.
SonarQube provides strong security and governance capabilities by enforcing secure coding standards and consistent code quality across all teams.
Some of the static code analysis capabilities are the most beneficial.
| Product | Mindshare (%) |
|---|---|
| SonarQube | 13.3% |
| Harness | 0.7% |
| Other | 86.0% |

| Company Size | Count |
|---|---|
| Small Business | 4 |
| Midsize Enterprise | 1 |
| Large Enterprise | 10 |
| Company Size | Count |
|---|---|
| Small Business | 44 |
| Midsize Enterprise | 24 |
| Large Enterprise | 80 |
Harness offers a comprehensive toolset for automating deployment processes and enhancing software update efficiency. It's lauded for its CI/CD capabilities, feature flagging, and real-time deployment monitoring. Key features include an intuitive UI, secret management, and robust rollback functionalities, all contributing to improved productivity and reduced errors in DevOps environments.
SonarQube leads automated code review, enhancing code quality and security in AI-driven SDLCs. It analyzes pull requests, providing developers with actionable feedback and AI-driven fixes before code merges. Trusted by top enterprises, it supports SaaS and self-managed deployments.
SonarQube supports a wide range of programming languages and integrates seamlessly with CI/CD tools like Jenkins. It is renowned for its static code analysis, code coverage, and security vulnerability detection. While its open-source foundation and scalability are praised, users seek enhanced integration across multiple languages, better security features, and improved documentation. Despite challenges, its ability to automate code inspections and ensure compliance with coding standards makes it essential in software development processes, facilitating continuous improvement.
What are the most important features?In industries like finance, healthcare, and automotive, SonarQube is leveraged for static code analysis, automating code inspections, and ensuring compliance with stringent standards. Teams integrate it into their CI/CD pipelines to maintain high-quality code, identify security vulnerabilities, and enhance code maintainability.
We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.