AppBreakup
Submit an app
SonarQube logo

SonarQube

Code quality and security analysis platform, available as a cloud service or self-hosted.

Free plan + paidOpen sourceSelf-hostableCode security and static analysis tools
Visit SonarQubeSee 3 alternatives
Verified facts
4 of 4
Alternatives ranked
3
Approved reviews
0
Visits sent from here
0

About SonarQube

SonarQube, from Sonar, checks code for bugs, maintainability issues and security vulnerabilities on every pull request, and blocks merges that fail its quality gates. It covers 30-plus languages plus infrastructure-as-code files, and its security side includes taint analysis for injection flaws and secrets detection. It comes in two forms: SonarQube Cloud, a hosted service that connects to GitHub, GitLab, Bitbucket or Azure DevOps, and SonarQube Server, which you run on your own infrastructure for full control over data. A free IDE extension gives instant feedback while you type. The cloud version has a free tier for small private projects and is free for public open-source repositories, while paid plans are priced by lines of code analysed. The community build of the server is open source under the LGPL. It's a common choice for teams that care as much about code quality as security, though the most advanced security features sit in higher tiers.

Best for: Teams that want quality gates for code quality and security on every pull request.

Pros and cons

What works

  • Combines code quality and security in one report
  • Choice of cloud service or self-hosted server
  • Free IDE extension for instant feedback
  • Free for public open-source projects

Why people leave

  • Pricing scales with lines of code, which gets costly for large codebases
  • Free private tier is limited to 50k lines of code
  • Advanced security features are kept for higher tiers

Top SonarQube alternatives

See all 3
  1. 1Semgrep logo
    Semgrep

    Quicker custom rules and per-contributor pricing instead of lines of code.

    66.5
  2. 2CodeQL logo
    CodeQL

    Deep vulnerability analysis built into GitHub, free on public repositories.

    62.6
  3. 3Snyk logo
    Snyk

    Better if dependency and container vulnerabilities matter more than code quality.

    59.6

Why people left SonarQube

In reviewers' own words, from reviews of the apps they moved to. These are their opinions, not ours.

No switching stories yet. If you moved away from SonarQube, review the app you switched to and tell us why.

Reviews

No approved reviews yet. How we verify reviewers

Write a review of SonarQube
Your rating of SonarQube

Never shown publicly. A work email helps us verify you.

What did you use it for, and what was good or bad? At least 40 characters.

A GitHub username, your company domain, or say you can send a screenshot. Verified reviews count more.

By submitting, you confirm you're at least 16 and agree to our terms. Your name, rating, review and the date are published; your email isn't. See our privacy policy.

SonarQube: common questions

Is SonarQube free?

SonarQube has a free plan and paid plans. Free plan: Private projects up to 50k LOC (checked on SonarQube's own site).

Is SonarQube open source?

Yes. You can also run it on your own server.

What platforms does SonarQube run on?

SonarQube is available for Web and Self-hosted.

What are the best alternatives to SonarQube?

The highest-ranked SonarQube alternatives right now are Semgrep, CodeQL and Snyk. See the full ranked list for pricing, platforms and verified facts.

See all 3 SonarQube alternatives