SonarCloud is overall a good tool for identifying code smells, bugs, and code duplication, but we've found that using Android Lint is more effective for our needs.
SonarQube Cloud (formerly SonarCloud) identifies vulnerabilities and security hotspots at the developer level with ease of setup and integration, especially with YAML pipelines. It excels in reporting code quality metrics such as code duplication and test coverage. However, it needs enhanced code issue solutions for CVEs, false positive management, improved dynamic code analysis compared to Veracode, and full integration with CI/CD pipelines to boost customization and flexibility.
