I have used it with python and also with Ai agents and the results have been great, when connect with agents, sonarqube results in auto rectification of code. Review collected by and hosted on G2.com.

Although it is very customizable and user-friendly, SonalLint can be very vague at times, there are times when it throws errors in the code like some auto wiring errors for spring-boot projects that are ignorable. Also, it does not have a way to understand and improve code complexity. Review collected by and hosted on G2.com.

I’ve been using SonarQube for more than three years, and overall it has been an amazing experience. I use the free version for code quality scanning, and the best part is how easily it integrates with our project and fits into our workflow. The UI is simple and straightforward, which makes the learning curve feel very manageable. On top of that, the free version includes almost all the features I need, so it covers my day-to-day requirements well. And the code scanning and quality check speed is good enough in the free version as well. Review collected by and hosted on G2.com.

In the free version, only 5 users are allowed across the organization account, which feels too limited. It should allow at least 10 users. Also, the free version doesn’t include PR analysis; it would be much more useful if it allowed at least one PR/branch analysis per account. Review collected by and hosted on G2.com.

SonarQube has evolved beyond traditional code quality scanning with stronger security scanning and AI fixes. AI CodeFix is particularly useful for generating remediation suggestions for detected issues, while improved IDE integration helps developers identify and fix issues earlier in the development lifecycle. The addition of software composition analysis and SBOM capabilities also provides better visibility into dependency and supply-chain risks. Review collected by and hosted on G2.com.

SonarQube has improved considerably, but there is still room to make the platform more competitive with newer AI-native developer security tools. AI-assisted remediation could be expanded to cover more rules and languages, and the overall user experience could be made simpler. Better consolidation of code quality, SCA, SBOM and security findings into a single risk-focused view would also be valuable for larger engineering teams. Review collected by and hosted on G2.com.

What I like most about SonarQube is that it catches code quality issues early and clearly shows what needs attention. The reports are easy to understand, and it helps us fix bugs and maintain cleaner code before changes move further along. It also saves time during code reviews because some common issues are already flagged. Review collected by and hosted on G2.com.

Sometimes SonarQube flags issues that aren’t really a problem for our specific codebase, so we end up spending extra time reviewing them or dismissing them as not applicable. The initial setup and configuration can also take a bit of time to get right. Aside from those points, it works well for what we need. Review collected by and hosted on G2.com.

What I like best about SonarQube is how it makes code quality easy to understand and improve. Instead of just pointing out bugs, it also highlights security vulnerabilities, code smells, and maintainability issues in a clear and organized way. The quality gates are especially useful because they help catch problems before code is merged, encouraging better coding practices across the team. It also integrates well with CI/CD pipelines, making code reviews more efficient and helping developers build cleaner, more reliable software from the start. Review collected by and hosted on G2.com.

One thing I dislike about SonarQube is that it can sometimes produce false positives or flag issues that are not very relevant to the project. It also takes some time to fine-tune the rules so they match a team's coding standards, especially for larger codebases. For beginners, the number of reported issues can feel overwhelming at first, making it hard to know what to prioritize. While it's a powerful tool, it works best when its recommendations are reviewed with context rather than treated as absolute. Review collected by and hosted on G2.com.

I like SonarQube because it provides continuous feedback on code quality. It helps me spot bugs, security issues, code smells, and code duplication early in the development process. The Quality Gates and CI/CD integration also make it easier to ensure that only clean, maintainable code gets merged into the project. Review collected by and hosted on G2.com.

One thing I don’t like is that SonarQube can sometimes generate false positives, which then require a manual review. The analysis can also take longer on large projects, and setting up the rules the first time takes some effort. Still, overall I find it a valuable tool for maintaining code quality. Review collected by and hosted on G2.com.

What I like best is that SonarQube catches issues before they ever reach production. The static analysis runs automatically in our CI pipeline, so every pull request gets flagged for code smells, bugs, and security vulnerabilities without anyone having to remember to check manually. The Quality Gate feature is the standout for us — it blocks merges that don't meet our thresholds, which has cut down on the "we'll fix it later" tech debt that used to pile up. I also lean on the detailed rule explanations; instead of just saying "this is wrong," it explains why and how to fix it, which has genuinely helped level up our more junior developers. An unexpected benefit was the coverage tracking over time — being able to see the trend line has made it much easier to justify testing investments to leadership. Review collected by and hosted on G2.com.

Setup can be a pain honestly. Getting the initial config right with our CI took longer than expected and the docs arent always clear. Also the false positives can be annoying sometimes, you end up marking stuff as wont fix pretty often. Wish the integrations were a bit more plug and play. Review collected by and hosted on G2.com.

SonarQube does a great job of continuously identifying code quality issues, bugs, security vulnerabilities, and technical debt all in one place. This helps teams keep their codebase cleaner, more reliable, and more secure throughout the development process. I also think the coding standards it defines are very well chosen. Review collected by and hosted on G2.com.

It takes a lot of time to run it, running locally is very difficult for each type of project. Review collected by and hosted on G2.com.

I like SonarQube’s ability to automatically identify code quality issues, bugs, and security vulnerabilities. It provides developers with clear, actionable feedback during development and helps maintain consistent code quality across the entire project. Review collected by and hosted on G2.com.

Sometimes SonarQube reports too many minor or low-priority issues, which can create noise and make it harder to focus on the most important problems. Some rules can also require extra effort to understand or resolve. Review collected by and hosted on G2.com.

It’s a standalone and automated gatekeeper of my code quality and security that reduces dependency on peer reviews to discover a critical bug. It helps me catch those sneaky bugs and code smells thus preventing poor code from moving to production. Review collected by and hosted on G2.com.

We’ve observed little bit of false positive fatigue that kicks in sometimes owing to perfectly written code being flagged as a bug thus causing team to spend lots of time arguing with the tool, and eventually commenting few things out. CPU utilisation is typically seen to be high when CI/CD pipeline is undergoing Sonarqube checks. Review collected by and hosted on G2.com.