Try our new research platform with insights from 80,000+ expert users

GitHub Advanced Security vs SonarQube Server (formerly SonarQube) comparison

 

Comparison Buyer's Guide

Executive SummaryUpdated on Oct 30, 2024
 

Categories and Ranking

GitHub Advanced Security
Ranking in Application Security Tools
15th
Average Rating
8.8
Number of Reviews
7
Ranking in other categories
No ranking in other categories
SonarQube Server (formerly ...
Ranking in Application Security Tools
1st
Average Rating
8.0
Number of Reviews
113
Ranking in other categories
Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)
 

Mindshare comparison

As of November 2024, in the Application Security Tools category, the mindshare of GitHub Advanced Security is 7.5%, up from 0.6% compared to the previous year. The mindshare of SonarQube Server (formerly SonarQube) is 26.7%, down from 27.7% compared to the previous year. It is calculated based on PeerSpot user engagement data.
Application Security Tools
 

Featured Reviews

SirinatPaphatsirinatthi - PeerSpot reviewer
Jan 15, 2024
Initial setup was very easy, scalable product and stable product
We keep our firewall security in place. Customers use GitHub because they don't want to coordinate with many tools.  GitHub provides advanced security, which is why the customers choose this tool; it allows them to rely solely on GitHub as one platform for everything they need For customers,…
Wang Dayong - PeerSpot reviewer
May 10, 2023
Easy to integrate and has a plug-in that supports both C and C++ languages
We use the product to review our software codes. We have integrated the product to review our new delivery code When we deliver a code, the solution scans the code and reports whether the code has bugs or any other vulnerability issues. Thus the solution helps us identify issues and improve the…

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:
 

Pros

"The most valuable is the developer experience and the extensibility of the overall ecosystem."
"Dependency scanning is a valuable feature."
"GitHub Advanced Security uses artificial intelligence in the backend, specifically CodeQL, to analyze code and provide fewer but more reliable findings, so there are less false positives."
"It ensures user passwords or sensitive information are not accidentally exposed in code or reports."
"The product's most valuable features are security scan, dependency scan, and cost-effectiveness."
"It is a stable solution...It is a scalable solution as it can handle new applications along with the analysis part."
"GitHub provides advanced security, which is why the customers choose this tool; it allows them to rely solely on GitHub as one platform for everything they need."
"The most valuable features are the analysis and detection of issues within the application code."
"Code Convention: Using the tool to implement some sort of coding convention is really useful and ensures that the code is consistent no matter how many contributors."
"Issue Explanations: Documentation with detailed samples. Helps in growing technical knowledge and re-writing logic to conforming solutions."
"The overall quality of the indicator is good."
"The most valuable features are the wide array of languages, multiple languages per project, the breakdown of bugs, and the description of vulnerabilities and code smells (best practices)."
"The solution is stable."
"The solution has a wide variety of features and an open-source community that you are able to learn Java, JavaScript, or any other programing language."
"We are using the Community edition. So, we don't have to incur any licensing costs. This is the best part."
 

Cons

"The customizations are a little bit difficult."
"There could be DST features included in the product."
"There could be a centralized dashboard to view reports of all the projects on one platform."
"The deployment part of the product is an area of concern that needs to be made easier from an improvement perspective."
"A more refined approach, categorizing and emphasizing specific vulnerabilities, would be beneficial."
"Maybe make it compatible with more programming languages. Have a customized ruleset where the end-user can create their own rules for scanning."
"The report limitations are the main issue."
"SonarQube is not development-centric like Snyk."
"The solution is a bit lacking on the security side, in terms of finding and identifying vulnerabilities."
"New plug-ins should be integrated into SonarCloud to give more flexibility to the product."
"A little bit more emphasis on security and a bit more security scanning features would be nice."
"SonarQube can improve by scanning the internal library which currently it does not do. We are looking for a solution for this."
"The time it took for me to do the whole process was approximately two hours because I had to download, read the documentation, and do the configurations."
"If you don't have any experience with the configuration or how to configure the files, it can be complicated."
"It requires advanced heuristics to recognize more complex constructs that could be disregarded as issues."
 

Pricing and Cost Advice

"The solution is expensive."
"The current licensing model, which relies on active commitments, poses challenges, particularly in predicting and managing growth."
"Some of the plugins that were previously free are not free now."
"There are many different packages with different pricing options available. We are able to try what we have and if we need extra features we can upgrade the license."
"We're using the Community Edition, and we don't pay for anything."
"It's an open-source solution, with no additional costs."
"I think comparing the product to competitors it should be less expensive."
"The solution has a free version and a license version. The license is priced reasonably, the cost of hiring one programmer is more expensive than the solution."
"The costs for this application, for the kind of job it does, are pretty decent."
"Can try developer version for 14 days on the free trial."
report
Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.
814,528 professionals have used our research since 2012.
 

Top Industries

By visitors reading reviews
Financial Services Firm
14%
Computer Software Company
12%
Manufacturing Company
9%
Insurance Company
6%
Financial Services Firm
17%
Computer Software Company
15%
Manufacturing Company
13%
Government
6%
 

Company Size

By reviewers
Large Enterprise
Midsize Enterprise
Small Business
 

Questions from the Community

What do you like most about GitHub Advanced Security?
It is a stable solution...It is a scalable solution as it can handle new applications along with the analysis part.
What needs improvement with GitHub Advanced Security?
Maybe make it compatible with more programming languages. Have a customized ruleset where the end-user can create their own rules for scanning. Also, support for container stuff, like when the code...
What is your primary use case for GitHub Advanced Security?
I use it for Azure DevOps, for example. This tool focuses on the security of the code. It performs code analysis to identify security issues, such as hard-coded secrets and passwords, potential SQL...
Is SonarQube the best tool for static analysis?
I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...
Which gives you more for your money - SonarQube or Veracode?
SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...
How would you decide between Coverity and Sonarqube?
We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...
 

Also Known As

No data available
Sonar
 

Learn More

 

Interactive Demo

Demo not available
 

Overview

Find out what your peers are saying about GitHub Advanced Security vs. SonarQube Server (formerly SonarQube) and other solutions. Updated: October 2024.
814,528 professionals have used our research since 2012.