--- title: SonarQube Reviews meta_title: 'SonarQube Reviews 2026: Details, Pricing, & Features | G2' meta_description: Filter 154 reviews by the users' company size, role or industry to find out how SonarQube works for a business like yours. aggregate_rating: rating_value: 4.4 review_count: 154 scale: '5' date_modified: '2026-07-23' parent_category: name: "DevSecOps\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t" url: https://www.g2.com/categories/devsecops --- # SonarQube Reviews **Vendor:** SonarSource Sàrl **Category:** [Static Code Analysis Tools](https://www.g2.com/categories/static-code-analysis) **Average Rating:** 4.4/5.0 **Total Reviews:** 154 ## About SonarQube Sonar, the industry standard for code verification and automated code review, helps reduce outages, improve security, and lower risks associated with AI and agentic coding. As an independent verification platform, Sonar enables organizations to securely develop at the speed of AI. Sonar is the foundation for high-performance software engineering, analyzing over 750 billion lines of code daily to ensure applications are secure, reliable, and maintainable. Rooted in the open source community, Sonar is trusted by 7M+ developers globally, including teams at ServiceNow, Booking.com, Deutsche Bank, AstraZeneca, and Ford Motor Company. ## SonarQube Pros & Cons **What users like:** - Users value how SonarQube **efficiently flags code quality and security issues** , ensuring a clean and maintainable codebase. (24 reviews) - Users value the **issue filtering and prioritization features** of SonarQube, enhancing focus on high-priority tasks. (20 reviews) - Users value the **issue identification and prioritization** features of SonarQube, improving focus on critical tasks. (19 reviews) - Users find SonarQube's **ease of use** invaluable for maintaining code quality and integrating seamlessly into development workflows. (18 reviews) - Users appreciate the **easy integrations** with existing CI/CD tools, enhancing their development workflow seamlessly. (18 reviews) - Users value the **seamless integration** of SonarQube with CI/CD pipelines, enhancing code quality management effortlessly. (18 reviews) - Security (15 reviews) - Vulnerability Detection (15 reviews) - Code Review (12 reviews) - Integration Support (12 reviews) **What users dislike:** - Users face challenges with **software bugs** as SonarQube can consume excessive RAM and occasionally reports false positives. (12 reviews) - Users find SonarQube's configuration **complex** , especially for beginners, leading to difficulties and overwhelming warnings to manage. (10 reviews) - Users encounter **false positives** that complicate evaluations, though mitigation options exist through detailed analysis and rule customization. (10 reviews) - Users find that SonarQube's **complexity in configuration** and excessive warnings can hinder effective usage and efficiency. (8 reviews) - Users find the **complex setup** of SonarQube challenging, especially for beginners unfamiliar with the configuration process. (8 reviews) - Users often face **integration issues** with SonarQube, particularly in connecting to GitLab and navigating its complexities. (8 reviews) - Users find SonarQube's **limited features** frustrating, particularly with restrictions on scanning and analysis capabilities. (8 reviews) - Users note that the **expensive nature** of SonarQube limits access to advanced features and complicates setup. (7 reviews) - Difficult Setup (6 reviews) - Setup Difficulty (6 reviews) ## SonarQube Reviews ### 1. Code Analytics Tool That Has Gotten Better with Age **Rating:** 4.5/5.0 stars **Reviewed by:** Samuel B. | Principal Consultant/Continuous Delivery and Containers Practices Lead, Information Technology and Services, Mid-Market (51-1000 emp.) **Reviewed Date:** October 19, 2016 **What do you like best about SonarQube?** Sonarqube is my one stop shop to find out the health of my code and the ability to integrate it with build tools and continuous integration ensures I'm always getting up to date information. It can quickly help you highlight trouble (hot-spots) in your code base and has integration with JIRA so that you can create a ticket and make sure the work to fix it isn't lost. Support for multiple projects with multiple configurations is also a huge plus because not all projects are the same. Sonarqube has been my go-to code analytics tool for many years as a Java developer. **What do you dislike about SonarQube?** Initial set up when using build tools like Maven or Gradle can be a bit challenging if you're just learning but once you've got the set up correct you usually don't need to edit it much after that point. **Recommendations to others considering SonarQube:** I wouldn't hesitate to plug SonarQube into one of your current projects and see what metrics it can generate for you and if they are helpful. I have a feeling that once you start to see what it can uncover that you'll use it more often than not to feel confident that your code is healthy and that your team is adhering to best practices for your company and the wider coding community. **What problems is SonarQube solving and how is that benefiting you?** I use SonarQube to ensure that my team and I are adhering to coding best practices defined as static rules and that we are maintaining good code coverage while not adding to technical debt. Sonarqube makes it extremely simple to tweak what is/is not considered technical debt for your team and as mentioned, makes it easy to identify hot spots to remedy. I use SonarQube as an early warning system that there may be some issues in the code that the team needs to address and the dashboard and drill down metrics make it easy to identify these issues. ### 2. Valuable tool for code quality analysis **Rating:** 3.5/5.0 stars **Reviewed by:** Verified User in Aviation & Aerospace | Small-Business (50 or fewer emp.) **Reviewed Date:** October 19, 2016 **What do you like best about SonarQube?** After getting the setup right, it's a "set it and forget it" solution. Also, the defaults are very sensible and we rarely needed to change them. It is very useful and provides a good integration with our existing build system, including Gradle and Jenkins. We recently upgraded to a newer major version and the upgrade went almost completely smooth, which is a big plus. **What do you dislike about SonarQube?** The setup can be somewhat frustrating and (especially for older versions) some of the functionality, like the history, can be very, very slow. This got fixed in recent versions but now you can have huge, huge elastic search indices, which can be somewhat of a problem. **Recommendations to others considering SonarQube:** It's a very nice tool but make sure to have somebody who can administer and set it up correctly, as the integration with different database backends, etc. can be troublesome at times. **What problems is SonarQube solving and how is that benefiting you?** We are using it, surprise, to keep up with our code quality. This means that it is integrated with our continuous builds and reports are autogenerated when builds happen. The main benefit is that it not only does the analysis but gives the reason why something was marked and how to solve it. ### 3. Static Code Analysis with centralized reporting and tracking made easy! **Rating:** 5.0/5.0 stars **Reviewed by:** Eric M. | Principal System Architect, Telecommunications, Enterprise (> 1000 emp.) **Reviewed Date:** June 24, 2016 **What do you like best about SonarQube?** The ability to run both locally within your IDE (Eclipse, Jetbrains, etc) via the SonarQube plugin so you can correct any issues before committing your code, and you can also run it from your CI server (I use Bamboo) as part of the build step. There are quality gates that will let you fail the build if it doesn't meet certain quality criteria. That quality gate can fail the build. PCI compliance requires that you perform static code analysis against your in-scope code. This tool is a great addition to your code deployment pipeline! It also supports many languages such as Java, Python, C but expect to pay for plugins for Objective-C and Swift. **What do you dislike about SonarQube?** They discontinued the JIRA plugin that allows you to create a story for a problem found in your code, right within the SonarQube web interface. I feel like everyone uses JIRA for story/bug tracking so why get rid of that plugin? **Recommendations to others considering SonarQube:** It is a free (excluding the extra plugins and support they offer), open source project and only takes an hour to get up and running. It will help you understand your code better and become a better coder overall. **What problems is SonarQube solving and how is that benefiting you?** To ensure quality code and meet PCI compliance requirements, SonarQube allows us to analyze code from a central location and make it part of the code deployment pipeline for all code before it ships. ### 4. SONARQube for the best code quality **Rating:** 4.5/5.0 stars **Reviewed by:** Attila C. | Angular Developer (Remote Contract), Mid-Market (51-1000 emp.) **Reviewed Date:** May 20, 2016 **What do you like best about SonarQube?** Several Integrated code quality tools like PMD, Checkstyle or Findbugs. Offer one place of configuration over your codebase Easy clear UI interface to get a great overview about your code quality from different angle Easy configuration for plugins **What do you dislike about SonarQube?** Some IDE's plugins not support all SONARQube version, so you should follow which plugin you should use to work properly with the latest versions. **Recommendations to others considering SonarQube:** You should identify which kind of quality you try to achieve and pick the right plugin You can always override SONARQube's default quality settings over PMD, Checkstyle or findbugs, so you can get the most out from this system. **What problems is SonarQube solving and how is that benefiting you?** Easy to integrate into agile workflow by defining / filtering code quality issues and define test for them By following the suggested code quality problems, you can increase your code quality rapidly. Thanks to plugins we can use this product to analyze different language based components ## SonarQube Discussions - [What is the benefit of SonarQube?](https://www.g2.com/discussions/what-is-the-benefit-of-sonarqube) - [What are the main components of SonarQube platform?](https://www.g2.com/discussions/what-are-the-main-components-of-sonarqube-platform) - [What is SonarQube and its features?](https://www.g2.com/discussions/what-is-sonarqube-and-its-features) - [What is the best way to integrate a plugin for the code coverage?](https://www.g2.com/discussions/what-is-the-best-way-to-integrate-a-plugin-for-the-code-coverage) - 1 upvote - [test coverage](https://www.g2.com/discussions/31154-test-coverage) - 1 upvote - [View SonarQube pricing details and edition comparison](https://www.g2.com/products/sonarqube/reviews?page=4§ion=pricing&secure%5Bexpires_at%5D=2026-07-23+10%3A22%3A14+-0500&secure%5Bsession_id%5D=5d52a22d-0232-4f10-8bcc-bade35327f28&secure%5Btoken%5D=deb0ba10ccd81f5283aab36c404a6e2c5097f736cbf1fe23e4a728b025ffce9e&format=llm_user) ## SonarQube Integrations - [Android Studio](https://www.g2.com/products/android-studio/reviews) - [Apache Maven](https://www.g2.com/products/apache-maven/reviews) - [Atlassian](https://www.g2.com/products/atlassian-2025-01-31/reviews) - [AWS CodeBuild](https://www.g2.com/products/aws-codebuild/reviews) - [AWS CodePipeline](https://www.g2.com/products/aws-codepipeline/reviews) - [AWS CodePipeline for CI/CD Automation](https://www.g2.com/products/aws-codepipeline-for-ci-cd-automation/reviews) - [Azure DevOps Server](https://www.g2.com/products/azure-devops-server/reviews) - [Azure Pipelines](https://www.g2.com/products/azure-pipelines/reviews) - [Backstage](https://www.g2.com/products/backstage/reviews) - [Bitbucket](https://www.g2.com/products/bitbucket/reviews) - [CircleCI](https://www.g2.com/products/circleci/reviews) - [Claude](https://www.g2.com/products/claude-2025-12-11/reviews) - [CloudBees](https://www.g2.com/products/cloudbees/reviews) - [Codemagic](https://www.g2.com/products/codemagic/reviews) - [Copado DevOps](https://www.g2.com/products/copado-devops/reviews) - [Cortex](https://www.g2.com/products/cortex-automation-inc-cortex/reviews) - [Cursor](https://www.g2.com/products/cursor/reviews) - [Datadog](https://www.g2.com/products/datadog/reviews) - [Devin AI](https://www.g2.com/products/devin-ai/reviews) - [Docker](https://www.g2.com/products/docker-inc-docker/reviews) - [Drata](https://www.g2.com/products/drata/reviews) - [DX](https://www.g2.com/products/dx-platform/reviews) - [Dynatrace](https://www.g2.com/products/dynatrace/reviews) - [Eclipse](https://www.g2.com/products/tph-global-eclipse/reviews) - [Gemini](https://www.g2.com/products/gemini-2021-11-09/reviews) - [GitHub](https://www.g2.com/products/github/reviews) - [GitLab](https://www.g2.com/products/gitlab/reviews) - [Google Cloud Console](https://www.g2.com/products/google-cloud-console/reviews) - [Google Cloud Tekton](https://www.g2.com/products/google-cloud-tekton/reviews) - [Gradle Build Tool](https://www.g2.com/products/gradle-build-tool/reviews) - [Harness](https://www.g2.com/products/harness-wealth-harness/reviews) - [IntelliJ IDEA](https://www.g2.com/products/intellij-idea/reviews) - [Jellyfish](https://www.g2.com/products/jellyfish-2018-10-15/reviews) - [Jenkins](https://www.g2.com/products/jenkins/reviews) - [JFrog](https://www.g2.com/products/jfrog-2024-03-28/reviews) - [Jira](https://www.g2.com/products/jira/reviews) - [LinearB](https://www.g2.com/products/linearb/reviews) - [Microsoft Visual Studio App Center](https://www.g2.com/products/microsoft-microsoft-visual-studio-app-center/reviews) - [MuleSoft Anypoint Platform](https://www.g2.com/products/mulesoft-anypoint-platform/reviews) - [npm](https://www.g2.com/products/npm/reviews) - [Oobeya](https://www.g2.com/products/oobeya/reviews) - [Port](https://www.g2.com/products/port-port/reviews) - [PyCharm](https://www.g2.com/products/pycharm/reviews) - [Python](https://www.g2.com/products/python/reviews) - [ServiceNow DevOps](https://www.g2.com/products/servicenow-devops/reviews) - [Slack](https://www.g2.com/products/slack/reviews) - [Travis CI](https://www.g2.com/products/travis-ci/reviews) - [Visual Studio](https://www.g2.com/products/visual-studio/reviews) - [Visual Studio Code](https://www.g2.com/products/visual-studio-code/reviews) - [Zed](https://www.g2.com/products/zed-zed/reviews) ## SonarQube Features **Administration** - API / Integrations - Extensibility **Functionality** - Repository Integration - Analytics and Trends - Productivity Updates **Bug Reporting** - User Reports & Feedback - Tester Reports & Feedback - Team Reports & Comments **Functionality - Software Composition Analysis ** - Language Support - Integration - Transparency **Documentation** - Feedback - Prioritization - Remediation Suggestions **Risk management - Application Security Posture Management (ASPM)** - Vulnerability Management - Compliance Management - Policy Enforcement **Functionality - Software Bill of Materials (SBOM)** - Format Support - Annotations - Attestation **AI Compliance** - Regulatory Reporting - Automated Compliance **Agentic AI - Static Code Analysis** - Adaptive Learning - Natural Language Interaction - Proactive Assistance **Performance - AI AppSec Assistants** - Remediation - Real-time Vulnerability Detection - Accuracy **Analysis** - Reporting and Analytics - Issue Tracking - Static Code Analysis - Code Analysis **Management** - Data Context - Testing Integration **Bug Monitoring** - Analytics - Bug History - Data Retention **Effectiveness - Software Composition Analysis** - Remediation Suggestions - Continuous Monitoring - Thorough Detection **Security** - False Positives - Custom Compliance - Agility **Integration and efficiency - Application Security Posture Management (ASPM)** - Integration with Development Tools **Management - Software Bill of Materials (SBOM)** - Monitoring - Dashboards - User Provisioning **Risk Management & Monitoring** - Real-time Monitoring **Integration - AI AppSec Assistants** - Stack Integration - Workflow Integration - Codebase Contextual Awareness **Security** - Data Security - Data loss Prevention - Security Auditing **Testing** - Command-Line Tools - Manual Testing - Test Automation - Compliance Testing - Black-Box Scanning - Detection Rate - False Positives **Reporting and Analytics - Application Security Posture Management (ASPM)** - Trend Analysis - Risk Scoring - Customizable Dashboards **Agentic AI - Bug Tracking** - Adaptive Learning - Natural Language Interaction - Proactive Assistance **Identity** - SSO - Governance - User Analytics **Access Control and Security** - Pole-based Access Control (RBAC) **Agentic AI - Static Application Security Testing (SAST)** - Autonomous Task Execution **Agentic AI - Application Security Posture Management (ASPM)** - Autonomous Task Execution - Multi-step Planning **Agentic AI - AI Governance Tools** - Autonomous Task Execution - Multi-step Planning - Cross-system Integration - Adaptive Learning - Natural Language Interaction - Decision Making ## Top SonarQube Alternatives - [GitHub](https://www.g2.com/products/github/reviews) - 4.7/5.0 (2,315 reviews) - [GitLab](https://www.g2.com/products/gitlab/reviews) - 4.5/5.0 (882 reviews) - [Veracode Application Security Platform](https://www.g2.com/products/veracode-application-security-platform/reviews) - 3.8/5.0 (25 reviews)