SonarQube is its ability to identify and highlight code quality issues. It can detect coding errors, code smells, and potential bugs, enabling developers to fix them before they become more significant problems Review collected by and hosted on G2.com.

SonarQube can be complex and difficult to configure

community version can only be integrated with one branch, and the enterprise version is expensive Review collected by and hosted on G2.com.

Cloud based and hence no need to install on any server. Integrates into various version control systems using CI/CD pipelines. Has a huge database of various rules per coding platform. Helps in scanning large quantities of code efficiently. Also, provides insights into possible security misconfigurations. Review collected by and hosted on G2.com.

Initial setup is a little difficult, but manageable. Can give a lot of false positives. If the number of lines cross a particular threshold the overall scan is taking a very long time. Review collected by and hosted on G2.com.

Amazing user interface, fast learning curve, faster installation and deployment, good customer support, security scanning features and code smells Review collected by and hosted on G2.com.

lacks in good graphs and reports generations, not very easy to customize the reports and export them, webAPI is not value for money Review collected by and hosted on G2.com.

SonarQube is an excellent tool for maintaining code quality and enforcing code quality rules organization-wide. It has a free and open-source version which can be self-hosted. Badges can also be created, which can be embedded in repos. It can be integrated with the CICD process Review collected by and hosted on G2.com.

The free and open source version can be pretty limited and restrictive (it does not allow per-branch scanning, and only one branch can be analyzed at once) The Enterprise version / Cloud version is quite expensive for a small startup Review collected by and hosted on G2.com.

If you don't have much budget to go for SAST products, it's good to go for this product, it's good and provides most of the best practices. Review collected by and hosted on G2.com.

It's not easy to integrate with CI/CD pipeline also you might not get very frequent or recent security recommendations like the commercial products. Review collected by and hosted on G2.com.

SonarLint is very helpful IDE extension for Sonar Analysis. It helps me in writing bug-free code by highlighting the bugs or defects in the code. Also, it suggests fixes for the highlighted bugs. Review collected by and hosted on G2.com.

Do not find anything to dislike, overall good experience so far and it helps a lot during the code development. Review collected by and hosted on G2.com.

SonarCloud is a cloud-based code analysis service that helps in detecting and fixing bugs, vulnerabilities, code issues, and other quality issues in your code. One of the best features I like about it is its integration with various CI/CD tools like GitLab, GitHub etc. Review collected by and hosted on G2.com.

As SonarCloud is used on-the-go cloud analysis tool for the code. So, just like any other tool in the market in this particular category, it increases the complexity of the programming for the first-time, and later on some minor maintenance is needed which is fine. Review collected by and hosted on G2.com.

The Pull Request Analysis is our best option to keep your code clean of bugs and reduce manual work, increase test coverage and in the overall align the code quality across all your repositories in the most automated way possible by entirely using Github Actions, in our days it has become an indispensable tool for all software engineer team. Review collected by and hosted on G2.com.

The software fully does what it says it does; there is nothing to complain about. Fair price, has awesome features, 100% availability. the only added feature I believe it can be added is the ability to produce reports using multiple repos. Review collected by and hosted on G2.com.

Supports major Cloud Providers/Cloud Platforms and Many popular Programming Languages. We are in the age of the Security left shift. The integration of SonarLint with IDE brings security even when code is pushed to source control. Review collected by and hosted on G2.com.

Data Privacy, Data Sovereignty(Some countries/organizations don't allow your data to go outside your network even if it's an analysis result data). Cost is another factor. Sometimes it produces a large number of false positives. Review collected by and hosted on G2.com.

- Provides a wide range of code analysis tools that help developers identify and fix code quality issues, security vulnerabilities, and bugs.

- Offers support for a wide range of programming languages, including Java, C/C++, C#, Python, and many more.

- Integrates with a variety of popular build systems, CI/CD pipelines, and code repositories, including Jenkins, Azure DevOps, GitHub, and GitLab, making it easy to incorporate SonarQube into existing workflows. Review collected by and hosted on G2.com.

- Sometimes it may produce false positives or miss certain types of code quality issues, requiring developers to perform additional manual code review.

- The documentation can be overwhelming, and some of users with which I have worked with have face difficulties in finding the information they need. Review collected by and hosted on G2.com.