SonarQube Reviews

Name: SonarQube
Brand: Sonar
Rating: 4 (113 reviews)

Vendor: Sonar

4.0 out of 5

113 reviews
81% willing to recommend

3,589 followers

Post review

What is SonarQube?

SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating seamlessly with the top DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of your release pipeline, displaying pass/fail results for new code based on quality profiles you customize to your company standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production.

Get the SonarQube Buyer's Guide and find out what your peers are saying about SonarQube, Veracode, GitLab and more!

SonarQube is the #1 ranked solution in application security solutions, AST tools, and top Software Development Analytics solutions. PeerSpot users give SonarQube an average rating of 8.0 out of 10. SonarQube is most commonly compared to Veracode: SonarQube vs Veracode. SonarQube is popular among the large enterprise segment, accounting for 70% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 17% of all views.

Helped 800,905 peers since 2012

Featured reviews

Wang Dayong

Senior Software Engineering Manager at Hill

We use the product to review our software codes. We have integrated the product to review our new delivery code When we deliver a code, the solution scans the code and reports whether the code has bugs or any other vulnerability issues. Thus the solution helps us identify issues and improve the…

Read full review

Devid William

Application Security Coordinator at Banco Votorantim

I work on vulnerability management. I use the security features in SonarQube. I also use Veracode. I use both solutions to verify each other’s results We see the security issues in our solutions with the help of the product. It helps us improve the solutions. There are many options and examples…

Read full review

Jaile Sebes

Senior Software Architect at Siemens Industry

I integrate SonarQube into my CI/CD pipeline by running it during the build process for static code analysis. Once the analysis is complete, the results are sent to the dashboard for easy monitoring and tracking of code quality. Using SonarQube for security vulnerability detection offers several benefits such as comprehensive security rule coverage and integration with the dashboard for easy monitoring. Additionally, SonarQube provides features like password handling, eliminating the need for separate tools and enhancing overall code security. SonarQube handles false positives during code analysis by allowing teams to review and exclude them, especially in long-term projects where patterns are familiar. While false positives may occur, experienced teams can easily identify and manage them, ensuring accurate analysis results. For software development, especially in Java-based environments, I highly recommend using SonarQube due to its effectiveness in ensuring code quality and minimizing potential issues. While there are free tools available, SonarQube's comprehensive support for various languages and its benefits make it a valuable choice for developers. Overall, I would rate SonarQube as an eight out of ten.

Read full review

SonarQube mindshare

Product category:

As of September 2024, the mindshare of SonarQube in the Application Security Tools category stands at 26.5%, down from 27.2% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Application Security Tools

Key learnings from peers

Last updated Sep 5, 2024

Valuable Features

"SonarQube's unit test coverage and exhaustive information at the module, project, and overall code repo levels are quite good."
"Offers multi-programming language support"
"Any developer can easily identify issues using the process flow or steps provided by SonarQube. In terms of integration, SonarQube makes it quite easy, simplifying the steps for users."

Room for Improvement

"Depending on the tool's configuration, sometimes you get false alarms that are unimportant to you."
"The tool needs to be more compatible with C/C++ language"
"In terms of analysis and findings, other tools provide more in-depth insights and detailed steps to mitigate or handle issues."

Pricing

"SonarQube is a cost-effective solution."
"We use the solution free of cost."
"The tool's pricing is reasonable."

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our SonarQube Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

13%

Government

Insurance Company

Retailer

Healthcare Company

Energy/Utilities Company

Educational Organization

University

Comms Service Provider

Construction Company

Media Company

Real Estate/Law Firm

Transportation Company

Non Profit

Hospitality Company

Legal Firm

Wholesaler/Distributor

Logistics Company

Outsourcing Company

Pharma/Biotech Company

Aerospace/Defense Firm

Recreational Facilities/Services Company

Engineering Company

Performing Arts

Consumer Goods Company

Compare SonarQube with alternative products

Learn more about SonarQube

At its core, SonarQube includes a static code analyzer that identifies bugs, security vulnerabilities, hidden secrets, and code smells. The platform guides you through issue resolution, fostering a culture of continuous improvement. SonarQube’s comprehensive reporting is a valuable tool for dev teams to monitor their codebase's overall health and quality across multiple projects in their portfolio. With SonarQube, you can achieve a state of Clean Code, leading to secure, reliable, and maintainable software.

Sonar is the only solution combining the power of industry-leading software quality analysis with static application security testing (SAST) and real-time coding guidance in the IDE (with SonarLint) to meet the DevOps and DevSecOps demand of putting agility, automation, and security in the hands of developers. Further accelerate DevOps continuous integration by helping developers find and fix issues in code before the software testing stage, reducing the churn of finding, fixing, rebuilding, and retesting your app.

With over 5,000 Clean Code rules, SonarQube analyzes 30+ of the most popular programming languages, including dozens of frameworks, the top DevOps platforms (GitLab, GitHub, Azure DevOps, and Bitbucket, and more), and the leading infrastructure as code (IaC) platforms.

SonarQube is the most trusted static code analyzer used by over 7 million developers and 400,000 organizations globally to clean over half a trillion lines of code.

SonarQube was previously known as Sonar.