GitHub vs SonarQube Server (formerly SonarQube) comparison

GitHub and Sonar are both solutions in the Application Security Tools category. GitHub is ranked #7 with an average rating of 8.9, while Sonar is ranked #1 with an average rating of 8.2. GitHub holds a 0.8% mindshare in AS, compared to Sonar’s 26.7% mindshare. Additionally, 100% of GitHub users are willing to recommend the solution, compared to 81% of Sonar users who would recommend it.

GitHub

Read 92 GitHub reviews

2,615 Views
1,126 Comparison Views

100% willing to recommend

SonarQube Server (formerly ...

Read 113 SonarQube Server (formerly SonarQube) reviews

40,107 Views
32,629 Comparison Views

81% willing to recommend

GitHub

SonarQube Server (formerly ...

Comparison Buyer's Guide

Download the report

Executive SummaryUpdated on Oct 30, 2024

SonarQube Server and GitHub compete in the software development tools category, with each offering unique features. GitHub seems to have the upper hand due to its strong collaboration and integration capabilities, while SonarQube excels in detailed code analysis.

Features: SonarQube Server offers support for over 20 programming languages and integrates with Eclipse. It allows developers to create custom coding rules and quality profiles, which aids in code quality and consistency. GitHub provides robust source code management and version control, making it essential for teams requiring seamless workflow integration and automation capabilities through GitHub Actions.

Room for Improvement: SonarQube could improve its support for mobile applications and better handle false positives. Users suggest enhancements in security scanning and integration features. GitHub would benefit from better integration with Jenkins and improved user management features, particularly around licensing options. Both products should enhance their security and offer more intuitive interfaces for non-technical users.

Ease of Deployment and Customer Service: SonarQube Server offers hybrid, on-premises, and private cloud deployment options, but relies on community forums for support for free users, with paid support commonly available. GitHub, favoring cloud deployments, is known for easy-to-follow documentation and a supportive community, although it can improve in handling licensing issues and integration complexities.

Pricing and ROI: SonarQube Server provides a free version with optional paid plugins, but enterprise features can be costly. However, it offers a good ROI through enhanced code quality and reduced defects. GitHub's pricing is more reasonable, offering a free tier along with enterprise options, making it a cost-effective choice, especially for smaller teams, and it delivers strong ROI through improved collaboration and shorter development cycles.

To learn more, read our detailed GitHub vs. SonarQube Server (formerly SonarQube) Report (Updated: December 2024).

Buyer's Guide

GitHub vs. SonarQube Server (formerly SonarQube)

December 2024

Download the complete report

Helped 824,168 peers since 2012

Categories and Ranking

GitHub

Ranking in Application Security Tools

7th

Average Rating

8.8

Reviews Sentiment

7.5

Number of Reviews

Ranking in other categories

Version Control (3rd)

SonarQube Server (formerly ...

Ranking in Application Security Tools

1st

Average Rating

8.0

Reviews Sentiment

7.5

Number of Reviews

113

Ranking in other categories

Static Application Security Testing (SAST) (1st), Software Development Analytics (1st)

Mindshare comparison

As of December 2024, in the Application Security Tools category, the mindshare of GitHub is 0.8%, down from 0.9% compared to the previous year. The mindshare of SonarQube Server (formerly SonarQube) is 26.7%, down from 27.4% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Application Security Tools

Featured Reviews

AjayKrishna

Senior Software Engineer at a transportation company with 10,001+ employees

Reduces project delivery times and costs

I think one area where GitHub could improve is its search and navigation functionality within repositories. For example, we use IDEs like IntelliJ or Visual Studio Code when developing code. These IDEs allow us to easily navigate from one piece of code to another file where a method is being called. It would be really helpful if the solution could add this navigation feature. It would allow us to move from one class file to another more easily, helping us search quicker and follow the code flow completely within GitHub. This would be more convenient than having to import the code into our local IDE to look at the code flow and navigate through it. Adding this kind of IDE-like navigation within the tool would make the user experience more seamless and efficient.

Read full review

Wang Dayong

Senior Software Engineering Manager at Hill

Easy to integrate and has a plug-in that supports both C and C++ languages

The product provides false reports sometimes. It also fails to understand the context of the code. It reports that a line of code has issues without considering its relation with the previous line. The product should improve the report quality. While it asks us to improve the code quality, it would be good if it also suggests how to improve the quality.

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"I find GitHub very user friendly."

"Even if I'm not in the office, I can access and work on my code from anywhere with my account credentials."

"The solution provides good customization and support."

"The tool is valuable because it helps us work in a distributed environment with multiple people across different locations and time zones. We have a common repository that everyone works on, which would be tough to manage manually. GitHub helps us maintain this single source of truth. Everyone can check out their own branches, which is important for our branching strategies. We can fork, check out feature branches, work on our code, and merge back into parent branches for deployment. This is crucial when multiple people are working on the same codebase."

"The features that I have found most valuable are that it can support you for most of the road map and it can automate some tasks which works really well with collaboration with the teams. They are really interested in how they organize the history of the code itself which is good."

"GitHub has improved the productivity of my team by simplifying code merging and enabling effective branching strategies."

"This product allows us to easily collaborate on development tasks with our subcontractors, and control the workflow as the project progresses."

"The best feature is the ability to track the history of all code changes, and it's easy to use. Additionally, as it's open source, anyone can use that feature resulting in distributed development. This opens the door to collaboration with different code and developer, feature, and master branches of development."

More GitHub pros

"One of the most valuable features of SonarQube is its ability to detect code quality during development. There are rules that define various technologies—Java, C#, Python, everything—and these rules declare the coding standards and code quality. With SonarQube, everything is detectable during the time of development and continuous integration, which is an advantage. SonarQube also has a Quality Gate, where the code should reach 85%. Below that, the code cannot be promoted to a further environment, it should be in a development environment only. So the checks are there, and SonarQube will provide that increase. It also provides suggestions on how the code can be fixed and methods of going about this, without allowing hackers to exploit the code. Another valuable feature is that it is tightly integrated with third-party tools. For example, we can see the SonarQube metrics in Bitbucket, the code repository. Once I raise the full request, the developer, team lead, or even the delivery lead can see the code quality metrics of the deliverable so that they can make a decision. SonarQube will also cover all of the top OWASP vulnerabilities, however it doesn't have penetration testing or hacker testing. We use other tools, like Checkmarx, to do penetration testing from the outside."

"It provides you with many features, as it does with the premium model, but there are still extra features that can be purchased if needed."

"SonarQube is admin friendly."

"It automatically scans for code, detects vulnerabilities, and generates daily reports."

"The solution has a wide variety of features and an open-source community that you are able to learn Java, JavaScript, or any other programing language."

"Using SonarQube has helped us to identify areas of technical debt to work on, resulting in better code, fewer vulnerabilities, and fewer bugs."

"The solution's user interface is very user-friendly."

"I like that it has a better dashboard compared to Clockwork. It's also stable."

More SonarQube Server (formerly SonarQube) pros

Cons

"While using the solution when merging two code branches the code becomes a bit messy. This should be improved in the future."

"Scalability is an area with a shortcoming, because of which it has room for improvement."

"It is difficult to merge a code or restore it to an older version."

"There is nothing that I find that needs improvement in GitHub."

"GitHub uses basic configuration, but messaging is not clear."

"From the recruiting standpoint, I would like to see email IDs and phone numbers and a brief introduction about their profile."

"The integration with Visual Studio Code could be more streamlined."

"There is a bit of a learning curve."

More GitHub cons

"It requires advanced heuristics to recognize more complex constructs that could be disregarded as issues."

"We found a solution with dynamic testing, and are looking to find a solution that can be used for both types of testing."

"I don't believe you can have metrics of code quality based upon code analysis. I don't think it's possible for a computer to do it."

"Their dashboarding is very limited. They can improve their dashboards for multiple areas, such as security review, maintainability, etc. They have all this information, so they should publish all this information on the dashboard so that the users can view the summary and then analyze it further. This is something that I would like to see in the next version."

"The time it took for me to do the whole process was approximately two hours because I had to download, read the documentation, and do the configurations."

"A robust credential scanner would be a huge bonus as it would remove the need for yet another niche product."

"There are times that we have the database crash. However, this might be an issue with how we have configured it and not a software issue. Apart from this, I do not see any issues with the solution."

"The software testing tool capability could improve. It does not always integrate well. You have to use a specific plugin and the plugin does not always go in Apple's applications."

More SonarQube Server (formerly SonarQube) cons

Pricing and Cost Advice

"The licensing model for GitHub is user-based. Whenever the new developer joins we have to get a new license and register their ID. The overall price of the solution is reasonable."

"We are currently paying nothing for GitHub."

"The tool offers a free program. As you go, you can upgrade from the community version to the professional one. I believe it costs about ten dollars per person, per month."

"GitHub is an open-source product, but when using the free-to-use version, anyone can see the code we're working on."

"It is open-source. There is no license for GitHub."

"I use the free version of GitHub."

"Regarding pricing, I'd rate it eight out of ten. It's decent and not too expensive, and small businesses can also afford it. With AWS taking CodeCommit out of the market, I don't see many competitors for small companies in terms of GitHub."

"I haven't had to pay anything for GitHub, I use the free version."

More GitHub pricing and cost advice

"It's an open-source solution, with no additional costs."

"It's a bit expensive for us. The currency rate of the dollar is a problem but it may be fine for other countries."

"We are using the open-source community version, but there are enterprise licenses available."

"We did not purchase a license (required for C++ support), but this option was considered."

"I do not know about the pricing as I am using the community edition, which is free. But I compared the pricing with Sigma, and it is higher than SonarQube."

"I am satisfied with the pricing."

"We are using the free, unlicensed version."

"We use the free version; there are no hidden costs or licensing required."

More SonarQube Server (formerly SonarQube) pricing and cost advice

See which vendors are best for you

Use our free recommendation engine to learn which Application Security Tools solutions are best for your needs.

See recommendations

824,168 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Manufacturing Company

12%

Computer Software Company

12%

Financial Services Firm

12%

University

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

13%

Government

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

Questions from the Community

What do you like most about GitHub?

The control is the most valuable feature as developers can work on a single code.

See all answers

What is your experience regarding pricing and costs for GitHub?

I'm not aware of the costs associated with GitHub. I simply appreciate its efficiency in managing code and collaborating with team members.

See all answers

What needs improvement with GitHub?

I would like to see some AI functionality included in GitHub, similar to the features seen in GitLab, to enhance productivity. Additionally, offering limited free access to features like Copilot co...

See all answers

Is SonarQube the best tool for static analysis?

I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

See all answers

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

See all answers

Comparisons

Fortify on Demand vs GitHub

Compared 19% of the time

Snyk vs GitHub

Compared 17% of the time

AWS CodeCommit vs GitHub

Compared 14% of the time

Bitbucket vs GitHub

Compared 12% of the time

Mend.io vs GitHub

Compared 5% of the time

More GitHub Competitors

Checkmarx One vs SonarQube Server (formerly SonarQube)

Compared 16% of the time

Coverity vs SonarQube Server (formerly SonarQube)

Compared 12% of the time

SonarQube Cloud (formerly SonarCloud) vs SonarQube Server (formerly SonarQube)

Compared 12% of the time

GitHub Advanced Security vs SonarQube Server (formerly SonarQube)

Compared 10% of the time

Veracode vs SonarQube Server (formerly SonarQube)

Compared 9% of the time

More SonarQube Server (formerly SonarQube) Competitors

Product Reports

Buyer's Guide

GitHub

December 2024

Download GitHub product report

Buyer's Guide

SonarQube Server (formerly SonarQube)

November 2024

SonarQube Server (formerly SonarQube) report

Download SonarQube Server (formerly SonarQube) product report

Also Known As

No data available

Sonar

Learn More

GitHub

Sonar

Interactive Demo

Demo not available

GitHub

Sonar

Overview

GitHub is a web-based Git repository hosting service. It offers all of the distributed revision control and source code management (SCM) functionality of Git as well as adding its own features. Unlike Git, which is strictly a command-line tool, GitHub provides a Web-based graphical interface and desktop as well as mobile integration. It also provides access control and several collaboration features such as bug tracking, feature requests, task management, and wikis for every project.

SonarQube Server enhances code quality and security via static code analysis. It detects vulnerabilities, improves standards, and reduces technical debt, integrating into CI/CD pipelines.

SonarQube Server is a comprehensive tool for enhancing code quality and security. It offers static code analysis to identify vulnerabilities, improve coding standards, and reduce technical debt. By integrating into CI/CD pipelines, it provides automated checks for adherence to best practices. Organizations use it for code inspection, security testing, and compliance, ensuring development environments with better maintainability and fewer issues.

What are the key features of SonarQube Server?

Support for 20+ languages: Extensive programming language support suitable for diverse coding environments.
Custom coding rules: Allows for tailored rule sets to match specific coding standards.
Flexible quality gates: Define criteria for code acceptance at various intervals.
CI/CD integration: Seamless integration with Continuous Integration/Continuous Deployment tools.
Rich interface: User-friendly dashboard with detailed visual insights.

What benefits should users expect from SonarQube Server?

Improved code quality: Enhanced analysis contributes to fewer bugs and improved coding practices.
Security enhancements: Identifies and mitigates security vulnerabilities pre-emptively.
Maintainability: Reduces technical debt, yielding long-term development efficiency.
Customizable: Flexibility in configuration aligns with specific project needs.

Many industries implement SonarQube Server to uphold coding standards, maintain security protocols, and streamline their software development lifecycle. In sectors like finance and healthcare, adhering to regulations and ensuring reliable software is critical, making SonarQube Server invaluable. It is often integrated into CI/CD pipelines, ensuring that code changes meet set standards before deployment. This approach enhances productivity and maintains compliance with industry-specific requirements.

Sample Customers

Dominion Enterprises, NASA, Braintree, SAP, CyberAgent

Information Not Available

Buyer's Guide

GitHub vs. SonarQube Server (formerly SonarQube)

December 2024

Free Report: GitHub vs. SonarQube Server (formerly SonarQube)

Find out what your peers are saying about GitHub vs. SonarQube Server (formerly SonarQube) and other solutions. Updated: December 2024.

DOWNLOAD NOW

824,168 professionals have used our research since 2012.

See our GitHub vs. SonarQube Server (formerly SonarQube) report.

See our list of best Application Security Tools vendors.

We monitor all Application Security Tools reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.