SonarQube
A static code analysis platform that flags bugs, maintainability issues and security vulnerabilities.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
About SonarQube
SonarQube runs static analysis on source code and reports on maintainability, reliability, technical debt and security issues, including vulnerabilities and security hotspots. It can suggest code fixes and integrates with CI/CD pipelines so problems are found before code reaches production.
It comes in two forms: SonarQube Server, which you host yourself, and SonarQube Cloud, a managed service. A companion SonarQube for IDE plugin gives feedback inside editors such as VS Code. It suits development teams that want automated code review.
Strengths
- Self-hosted server or managed cloud option
- Tracks technical debt and reliability as well as security
- CI/CD integration and IDE plugin
- Suggested fixes for detected issues
Limitations
- Running the server yourself needs infrastructure and maintenance
- Advanced features are in paid plans
Details
- Pricing
- FreemiumFree starting option, with paid plans for larger teams and more features.
- License
- Proprietary
- Developer
- SonarSource
- Platforms
- Web, Self-hosted
- How it runs
- Self-hosted, Hosted service
- Best suited for
- Development teams adding automated code quality and security checks to their pipeline
- Categories
- Security tools, Developer tools
- Last verified
- Added
- Provenance
- Facts checked against the developer's own pages and store listings, 1 sources on file.
Alternatives to SonarQube
Compare allSoftware that can replace SonarQube for an important use case, and what changes if you switch.
Snyk
A hosted developer security platform that scans code and applications for vulnerabilities.
Snyk focuses on vulnerability scanning of code, dependencies and containers as a hosted service with regional data residency. No self-hosted server option is listed.
CodeQL
A semantic code analysis engine from GitHub that lets you query source code to find vulnerabilities.
CodeQL focuses on security, querying source code for vulnerability patterns through a CLI and a VS Code extension. Free use is limited to research and open source code.
Similar software
Related functionality, not necessarily a direct replacement.
ESLint
A pluggable linter that finds and automatically fixes problems in JavaScript and JSX code.
Ruff
Lint and format Python code with one fast command-line tool.
Bandit
A command-line static analyser that finds common security issues in Python code.
Biome
A fast formatter and linter for JavaScript, TypeScript, JSON, CSS, HTML and GraphQL in one tool.
Qodo
An AI code review service that checks pull requests and IDE changes against full codebase context.
ShellCheck
Catch common shell-script mistakes before running them.
