SonarQube Server (formerly SonarQube) Reviews

Name: SonarQube Server (formerly SonarQube)
Brand: Sonar
Rating: 4.0 (113 reviews)

Vendor: Sonar

4.0 out of 5

113 reviews
81% willing to recommend

3,605 followers

Post review

What is SonarQube Server (formerly SonarQube)?

SonarQube Server enhances code quality and security via static code analysis. It detects vulnerabilities, improves standards, and reduces technical debt, integrating into CI/CD pipelines.

Get the SonarQube Server (formerly SonarQube) Buyer's Guide and find out what your peers are saying about SonarQube Server (formerly SonarQube), Veracode, GitLab and more!

SonarQube Server (formerly SonarQube) is the #1 ranked solution in application security solutions, AST tools, and top Software Development Analytics solutions. PeerSpot users give SonarQube Server (formerly SonarQube) an average rating of 8.0 out of 10. Based on the analysis of the 113 most recent SonarQube Server (formerly SonarQube) reviews, the overall sentiment is positive, with a sentiment score of 7.5. SonarQube Server (formerly SonarQube) is most commonly compared to Veracode: SonarQube Server (formerly SonarQube) vs Veracode. SonarQube Server (formerly SonarQube) is popular among the large enterprise segment, accounting for 69% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 17% of all views.

Buyer's Guide

SonarQube Server (formerly SonarQube)

November 2024

Get the report

Helped 823,875 peers since 2012

Featured reviews

Wang Dayong

Senior Software Engineering Manager at Hill

The product provides false reports sometimes. It also fails to understand the context of the code. It reports that a line of code has issues without considering its relation with the previous line. The product should improve the report quality. While it asks us to improve the code quality, it would be good if it also suggests how to improve the quality.

Read full review

Chetan Jayatheertha

DevOps Manager at a computer software company with 5,001-10,000 employees

We would like to have more visibility and more documentation, starting with the installation. It needs to be more standardized and explain all the features. We'd also like to get an idea of the level of stability we can get for our larger-sized projects. The notifications from the channel queue can be improved including email notifications. We currently rely on getting those notifications passed onto us and that should not be the case. The customization of different languages would also be helpful. If all the above could be implemented, SonarQube would be the best vulnerability security scanning tool.

Read full review

Jaile Sebes

Senior Software Architect at Siemens Industry

I integrate SonarQube into my CI/CD pipeline by running it during the build process for static code analysis. Once the analysis is complete, the results are sent to the dashboard for easy monitoring and tracking of code quality. Using SonarQube for security vulnerability detection offers several benefits such as comprehensive security rule coverage and integration with the dashboard for easy monitoring. Additionally, SonarQube provides features like password handling, eliminating the need for separate tools and enhancing overall code security. SonarQube handles false positives during code analysis by allowing teams to review and exclude them, especially in long-term projects where patterns are familiar. While false positives may occur, experienced teams can easily identify and manage them, ensuring accurate analysis results. For software development, especially in Java-based environments, I highly recommend using SonarQube due to its effectiveness in ensuring code quality and minimizing potential issues. While there are free tools available, SonarQube's comprehensive support for various languages and its benefits make it a valuable choice for developers. Overall, I would rate SonarQube as an eight out of ten.

Read full review

SonarQube Server (formerly SonarQube) mindshare

Product category:

As of December 2024, the mindshare of SonarQube Server (formerly SonarQube) in the Application Security Tools category stands at 26.7%, down from 27.4% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Application Security Tools

PeerAnalyst reports

Type	Title	Date
Category	Application Security Tools	Dec 17, 2024	Download
Product	Reviews, tips, and advice from real users	Dec 17, 2024	Download
Comparison	SonarQube Server (formerly SonarQube) vs Veracode	Dec 17, 2024	Download
Comparison	SonarQube Server (formerly SonarQube) vs Checkmarx One	Dec 17, 2024	Download
Comparison	SonarQube Server (formerly SonarQube) vs Snyk	Dec 17, 2024	Download

Title	Rating	Mindshare	Recommending
Veracode	4.1	10.4%	90%	196 interviews Add to research
GitLab	4.3	3.0%	97%	80 interviews Add to research

Valuable Features

SonarQube Server's most valuable features include multi-language support, customizable quality gates, seamless Jenkins integration, and a user-friendly dashboard. It provides deep code analysis, detects security vulnerabilities effectively, and enhances code quality through automated static analysis. The tight integration with development pipelines offers comprehensive reporting, allowing teams to manage coding standards efficiently. Its open-source model supports a broad community, while the ability to define custom rules and track technical debt assists in maintaining consistent code quality.

"SonarQube's unit test coverage and exhaustive information at the module, project, and overall code repo levels are quite good."
"Offers multi-programming language support"
"Any developer can easily identify issues using the process flow or steps provided by SonarQube. In terms of integration, SonarQube makes it quite easy, simplifying the steps for users."

Room for Improvement

SonarQube Server faces challenges with security features, false positives, and limited support for certain languages and integrations. Users express a need for better API documentation, improved interfaces, and enhanced automation capabilities. Complexity in integrating multiple tools, issues with update processes, and the requirement for more customizable scanning rules are areas highlighted for improvement. There is also a call for dynamic scanning, better handling of external libraries, and more comprehensive reports.

"Depending on the tool's configuration, sometimes you get false alarms that are unimportant to you."
"The tool needs to be more compatible with C/C++ language"
"In terms of analysis and findings, other tools provide more in-depth insights and detailed steps to mitigate or handle issues."

ROI

SonarQube Server reduces team effort in identifying code issues and enhances code quality and security. Users report positive ROI, finding vulnerabilities and improving stability. Though ROI is hard to quantify, better code is created with fewer defects over years of use. Users integrate it with tools like Jenkins, tracking metrics for fewer defects. The analysis engine needs improvement for better flaw detection, yet it effectively finds vulnerabilities, minimizing rework and improving code quality.

Pricing

SonarQube offers both free and paid versions, with many users finding the free open-source version sufficient for basic needs. Costs mainly arise from hosting, deployment, and commercial plugins. The paid Developer and Enterprise editions provide enhanced features and support, with costs varying based on codebase size. Licensing is generally seen as reasonable, with some suggesting that prices could be more competitive compared to other solutions. Self-hosting on existing infrastructure can be cost-efficient for larger organizations.

"SonarQube is a cost-effective solution."
"We use the solution free of cost."
"The tool's pricing is reasonable."

Popular Use Cases

SonarQube Server (formerly SonarQube) assists users in improving code quality by identifying issues related to bugs, vulnerabilities, and security. It is integrated into CI/CD pipelines for automating static code analysis. Users apply it to enhance code standards, reduce technical debt, and ensure security compliance. It provides immediate feedback on code, aiding developers in maintaining clean, well-structured, and secure codebases across various programming languages.

Service and Support

SonarQube Server's customer service is dependable, with robust community forums and extensive documentation. Many users rely on the community for guidance, finding online resources sufficient. Technical support is effective, particularly for paid versions, though some find response times lacking and support costly. Users value the active community and comprehensive documentation, achieving their needs without frequent direct assistance. Technical support receives mixed feedback, highlighting the importance of support packages for enhanced service levels.

Deployment

SonarQube Server's initial setup is largely straightforward, aided by good documentation. While some encounters complexities with specific integrations or scalability adjustments, many find it easy to install with minimal resources needed. Common themes point to a simple deployment process, often completed within hours or days. Some setups benefit from automation tools like Docker or Jenkins, and despite initial learning curves, users report a manageable adaptation period.

Scalability

SonarQube Server demonstrates good scalability, with no significant issues encountered. Most users experience seamless integration into their setups, handling multiple code bases and user numbers effectively. Some report increased resource needs with larger setups, particularly with physical machines. A few see performance drop under extensive loads. Despite some limitations, especially in the Community Edition, organizations with varied user bases find SonarQube Server to be scalable with adequate configuration and deployment.

Stability

SonarQube Server showcases high stability with generally few issues. Some common configuration challenges arise, but these are typically attributed to infrastructure or third-party plugins. Users often note its reliable performance, although occasional connectivity or resource constraints are mentioned. Users appreciate its improvement in newer versions and consider it mature and stable. Various departments utilize it effectively for daily tasks, underscoring its consistent reliability. Although some rate it slightly lower, it's acknowledged as a stable choice.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our SonarQube Server (formerly SonarQube) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

13%

Government

Insurance Company

Retailer

Healthcare Company

Energy/Utilities Company

Educational Organization

Comms Service Provider

University

Media Company

Construction Company

Non Profit

Real Estate/Law Firm

Transportation Company

Legal Firm

Hospitality Company

Logistics Company

Outsourcing Company

Wholesaler/Distributor

Pharma/Biotech Company

Aerospace/Defense Firm

Recreational Facilities/Services Company

Consumer Goods Company

Engineering Company

Performing Arts

Compare SonarQube Server (formerly SonarQube) with alternative products

Learn more about SonarQube Server (formerly SonarQube)

SonarQube Server is a comprehensive tool for enhancing code quality and security. It offers static code analysis to identify vulnerabilities, improve coding standards, and reduce technical debt. By integrating into CI/CD pipelines, it provides automated checks for adherence to best practices. Organizations use it for code inspection, security testing, and compliance, ensuring development environments with better maintainability and fewer issues.

What are the key features of SonarQube Server?

Support for 20+ languages: Extensive programming language support suitable for diverse coding environments.
Custom coding rules: Allows for tailored rule sets to match specific coding standards.
Flexible quality gates: Define criteria for code acceptance at various intervals.
CI/CD integration: Seamless integration with Continuous Integration/Continuous Deployment tools.
Rich interface: User-friendly dashboard with detailed visual insights.

What benefits should users expect from SonarQube Server?

Improved code quality: Enhanced analysis contributes to fewer bugs and improved coding practices.
Security enhancements: Identifies and mitigates security vulnerabilities pre-emptively.
Maintainability: Reduces technical debt, yielding long-term development efficiency.
Customizable: Flexibility in configuration aligns with specific project needs.

Many industries implement SonarQube Server to uphold coding standards, maintain security protocols, and streamline their software development lifecycle. In sectors like finance and healthcare, adhering to regulations and ensuring reliable software is critical, making SonarQube Server invaluable. It is often integrated into CI/CD pipelines, ensuring that code changes meet set standards before deployment. This approach enhances productivity and maintains compliance with industry-specific requirements.

SonarQube Server (formerly SonarQube) was previously known as Sonar.