Try our new research platform with insights from 80,000+ expert users

SonarQube pros and cons

Vendor: SonarSource Sàrl

4.0 out of 5

134 reviews
83% willing to recommend

Pros & Cons summary

SonarQube enhances software quality by promoting best practices, integrating with Jenkins and CI/CD pipelines, supporting multiple programming languages, and providing features like Quality Gate for consistent code standards. It excels in code analysis, detecting vulnerabilities, and estimating technical debt, while being cost-effective as an open-source solution. Improvements could focus on security scanning, language support, user guides, integration processes, and enhancing dynamic and static code analysis capabilities for a more streamlined experience.

Buyer's Guide

Get pricing advice, tips, use cases and valuable features from real users of this product.

Prominent pros & cons

PROS

SonarQube helps improve software quality by identifying bugs, vulnerabilities, and code smells, resulting in better code and fewer issues.

The tool integrates seamlessly into continuous integration pipelines and supports multiple languages for comprehensive code analysis.

The customizable Quality Gate feature allows teams to benchmark coding standards and ensure code quality is maintained.

SonarQube's security-focused features, including vulnerability detection and security hotspot identification, enhance code security.

Developers benefit from SonarQube's static code analysis capabilities, helping them grow technically and produce high-quality, secure code.

CONS

SonarQube lacks support for additional languages and ease of use in adding new rules.

Issues with false positives and insufficient security scanning capabilities are reported frequently.

Numerous users suggest improvements to the current support model and documentation updates.

Installation and initial setup of SonarQube can be complex, requiring significant effort and technical knowledge.

There is a need for better integration with third-party platforms and enhanced scalability.

SonarQube Pros review quotes

Lead Engineer at a healthcare company with 10,001+ employees

May 20, 2019

We have the software metrics that SonarQube gives us, which is something we did not have before. This helps us work towards aiming coding standards to empower us to move in the direction of better code quality. SonarQube provides targets and metrics for that.

Read full review

Lead Engineer at a healthcare company with 10,001+ employees

Jan 28, 2022

I like that it's easy to navigate not just in terms of code findings but you can actually see them in the context of your source code because it gives you a copy of your code with the items that it found and highlights them. You can see it directly in your code, so you can easily go back and make the corrections in the code. It basically finds the problems for you and tells you where they are.

Read full review

RR

Manager at kellton

Dec 10, 2021

One of the most valuable features of SonarQube is its ability to detect code quality during development. There are rules that define various technologies—Java, C#, Python, everything—and these rules declare the coding standards and code quality. With SonarQube, everything is detectable during the time of development and continuous integration, which is an advantage. SonarQube also has a Quality Gate, where the code should reach 85%. Below that, the code cannot be promoted to a further environment, it should be in a development environment only. So the checks are there, and SonarQube will provide that increase. It also provides suggestions on how the code can be fixed and methods of going about this, without allowing hackers to exploit the code. Another valuable feature is that it is tightly integrated with third-party tools. For example, we can see the SonarQube metrics in Bitbucket, the code repository. Once I raise the full request, the developer, team lead, or even the delivery lead can see the code quality metrics of the deliverable so that they can make a decision. SonarQube will also cover all of the top OWASP vulnerabilities, however it doesn't have penetration testing or hacker testing. We use other tools, like Checkmarx, to do penetration testing from the outside.

Read full review

Free Report: SonarQube Reviews and More

Learn what your peers think about SonarQube. Get advice and tips from experienced pros sharing their opinions. Updated: October 2025.

873,085 professionals have used our research since 2012.

reviewer1992327

Senior Software Engineer at a tech services company with 51-200 employees

Dec 11, 2023

SonarCloud is overall a good tool for identifying code smells, bugs, and code duplication, but we've found that using Android Lint is more effective for our needs.

Read full review

reviewer1407126

Team Lead at a computer software company with 10,001+ employees

Aug 30, 2020

It is a very good tool for analysis despite its limitations.

Read full review

Senior Java Developer at a financial services firm

Aug 29, 2017

Code Convention: Using the tool to implement some sort of coding convention is really useful and ensures that the code is consistent no matter how many contributors.

Read full review

Sthembiso Zondi

Head of Software Engineering at ronaldmariah@gmail.com

May 27, 2025

SonarQube Server (formerly SonarQube) is very stable.

Read full review

Cloud Engineer | Solution Architect at Respond.io

Dec 12, 2023

Recently, they introduced support for mono reports and microservices, which is a noteworthy development as it provides a more detailed view of each service.

Read full review

reviewer1078050

Staff DevOps Specialist at a computer software company with 201-500 employees

Nov 11, 2021

My focus is mainly on the DevOps pipeline side of things, and from my perspective, the ease of use and configuration is valuable. It is pretty straightforward to take a deployment pipeline or CI/CD pipeline and integrate SonarQube into it.

Read full review

HT

Information Technology Technical Architect at a insurance company with 51-200 employees

Sep 9, 2020

The product has a friendly UI that is easy to use and understand.

Read full review

Show 10 more reviews (out of 124)

SonarQube Cons review quotes

Lead Engineer at a healthcare company with 10,001+ employees

May 20, 2019

We've been using the Community Edition, which means that we get to use it at our leisure, and they're kind enough to literally give it to us. However, it takes a fair amount of effort to figure out how to get everything up and running. Since we didn't go with the professional paid version, we're not entitled to support. Of course that could be self-correcting if we were to make the step to buy into this and really use it. Then their technical support would be available to us to make strides for using it better.

Read full review

Lead Engineer at a healthcare company with 10,001+ employees

Jan 28, 2022

The learning curve can be fairly steep at first, but then, it's not an entry-level type of application. It's not like an introduction to C programming. You should know not just C programming and how to make projects but also how to apply its findings to the bigger picture. I've had users who said that they wish it was easier to understand how to configure, but I don't know if that's doable because what it's doing is a very complicated thing. I don't know if it is possible to make a complicated thing trivially simple.

Read full review

RR

Manager at kellton

Dec 10, 2021

SonarQube could be improved with more dynamic testing—basically, now, it's a static code analysis scan. For example, when the developer writes the code and does the corresponding unit test, he can cover functional and non-functional. So the SonarQube could be improved by helping to execute unit tests and test dynamically, using various parameters, and to help detect any vulnerabilities. Currently, it'll just give the test case and say whether it passes or fails—it won't give you any other input or dynamic testing. They could use artificial intelligence to build a feature that would help developers identify and fix issues in the early stages, which would help us deliver the product and reduce costs. Another area with room for improvement is in regard to automating things, since the process currently needs to be done manually.

Read full review

Free Report: SonarQube Reviews and More

Learn what your peers think about SonarQube. Get advice and tips from experienced pros sharing their opinions. Updated: October 2025.

873,085 professionals have used our research since 2012.

reviewer1992327

Senior Software Engineer at a tech services company with 51-200 employees

Dec 11, 2023

The documentation needs improvement on optimizing build time for seamless CI/CD integration with our Android apps.

Read full review

reviewer1407126

Team Lead at a computer software company with 10,001+ employees

Aug 30, 2020

There are limitations to the free version that limit development options as far as languages.

Read full review

Senior Java Developer at a financial services firm

Aug 29, 2017

An improvement is with false positives. Sometimes the tool can say there is an issue in your code but, really, you have to do things in a certain way due to external dependencies, and I think it's very hard to indicate this is the case.

Read full review

Sthembiso Zondi

Head of Software Engineering at ronaldmariah@gmail.com

May 27, 2025

I think SonarQube Server (formerly SonarQube) should improve by integrating a new feature that includes AI. As soon as I see that they've got a new feature that integrates AI that is not as generative as other GenAI platforms that actually generate the code and help developers develop faster, I believe that capability is lacking.

Read full review

Cloud Engineer | Solution Architect at Respond.io

Dec 12, 2023

There's room for improvement in the configuration process, particularly during the initial setup phase.

Read full review

reviewer1078050

Staff DevOps Specialist at a computer software company with 201-500 employees

Nov 11, 2021

A little bit more emphasis on security and a bit more security scanning features would be nice.

Read full review

HT

Information Technology Technical Architect at a insurance company with 51-200 employees

Sep 9, 2020

The documentation is not clear and it needs to be updated.

Read full review

Show 10 more reviews (out of 121)

Product Categories

Product Categories

Application Security Tools

Static Application Security Testing (SAST)

Software Development Analytics

Popular Comparisons

Popular Comparisons

Snyk vs SonarQube

GitLab vs SonarQube

Checkmarx One vs SonarQube

Veracode vs SonarQube

Coverity Static vs SonarQube

CrowdStrike Falcon Cloud Security vs SonarQube

Mend.io vs SonarQube

GitHub Advanced Security vs SonarQube

OpenText Core Application Security vs SonarQube

OWASP Zap vs SonarQube

Acunetix vs SonarQube

Sonatype Lifecycle vs SonarQube

HCL AppScan vs SonarQube

PortSwigger Burp Suite Professional vs SonarQube

Qualys Web Application Scanning vs SonarQube

See all alternatives

Product Categories

Product Categories

Application Security Tools

Static Application Security Testing (SAST)

Software Development Analytics

Popular Comparisons

Popular Comparisons

Snyk vs SonarQube

GitLab vs SonarQube

Checkmarx One vs SonarQube

Veracode vs SonarQube

Coverity Static vs SonarQube

CrowdStrike Falcon Cloud Security vs SonarQube

Mend.io vs SonarQube

GitHub Advanced Security vs SonarQube

OpenText Core Application Security vs SonarQube

OWASP Zap vs SonarQube

Acunetix vs SonarQube

Sonatype Lifecycle vs SonarQube

HCL AppScan vs SonarQube

PortSwigger Burp Suite Professional vs SonarQube

Qualys Web Application Scanning vs SonarQube

See all alternatives

Related questions

472

Is SonarQube the best tool for static analysis?

53

Which gives you more for your money - SonarQube or Veracode?

34

What Is The Biggest Difference Between Fortify on Demand And SonarQube?

48

What is the biggest difference between Checkmarx and SonarQube?

107

Checkmarx vs SonarQube; SonarQube interoperability with Checkmarx or Veracode

141

How does SonarQube instance relate to the license?

174

Which software is ideal for code quality and security?

128

What is the difference between Coverity and SonarQube?

43

What is the biggest difference between Coverity and SonarQube?

557

How would you decide between Coverity and Sonarqube?