SonarQube vs Synopsys API Security Testing comparison

Sonar and Synopsys are both solutions in the Static Application Security Testing (SAST) category. Sonar is ranked #1 with an average rating of 8.1, while Synopsys is ranked #35. Sonar holds a 29.2% mindshare in SAST, compared to Synopsys’s 0.1% mindshare. Additionally, 81% of Sonar users are willing to recommend the solution, compared to 100% of Synopsys users who would recommend it.

SonarQube

Read 113 SonarQube reviews

47,589 Views
38,299 Comparison Views

81% willing to recommend

Synopsys API Security Testing

Read 1 Synopsys API Security Testing review

275 Views
198 Comparison Views

100% willing to recommend

SonarQube

Synopsys API Security Testing

Comparison Buyer's Guide

Download the report

Executive Summary

We performed a comparison between SonarQube and Synopsys API Security Testing based on real PeerSpot user reviews.

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Static Application Security Testing (SAST).

To learn more, read our detailed Static Application Security Testing (SAST) Report (Updated: August 2024).

Buyer's Guide

Static Application Security Testing (SAST)

August 2024

Download the complete report

Helped 800,688 peers since 2012

Categories and Ranking

SonarQube

Ranking in Static Application Security Testing (SAST)

1st

Average Rating

8.0

Number of Reviews

113

Ranking in other categories

Application Security Tools (1st), Software Development Analytics (1st)

Synopsys API Security Testing

Ranking in Static Application Security Testing (SAST)

35th

Average Rating

7.0

Number of Reviews

Ranking in other categories

No ranking in other categories

Mindshare comparison

As of September 2024, in the Static Application Security Testing (SAST) category, the mindshare of SonarQube is 29.2%, up from 27.9% compared to the previous year. The mindshare of Synopsys API Security Testing is 0.1%, up from 0.1% compared to the previous year. It is calculated based on PeerSpot user engagement data.

Static Application Security Testing (SAST)

Featured Reviews

BudiSetiawan

IT Developer at PT Oto Multiartha

Dec 21, 2023

This solution is simple to use and can be quickly deployed

We use SonarQube to check for vulnerabilities and quality. The solution has helped us to find flaws in the Syntax and comply with requirements. I have found the most valuable features to be scanning for bugs or fixing the hotspot. These features have helped to improve the code quality. I…

Read full review

UmarQureshi

Security Lead at a retailer with 10,001+ employees

Apr 28, 2022

Useful threat vectors, beneficial results, but implementation needed support

We are using Synopsys API Security Testing for scanning APIs for risks and vulnerabilities and to understand our posture before deployment within our business The most valuable features of Synopsys API Security Testing are the metrics, results, and threat vectors that it shares. I have been…

Read full review

Quotes from Members

We asked business professionals to review the solutions they use. Here are some excerpts of what they said:

Pros

"There's plenty of documentation available to users."

"Code Convention: Using the tool to implement some sort of coding convention is really useful and ensures that the code is consistent no matter how many contributors."

"It is a very good tool for analysis and security vulnerability checking."

"The customizable dashboard and ability to include results and coverage from unit test and other static analysis code tools."

"We advise all of our developers to have this solution in place."

"SonarQube is admin friendly."

"The most valuable features are the dashboard, the ability to drill down to the code, user-friendly, and the technical debt estimation."

"We've configured it to run on each commit, providing feedback on our software quality. ]"

More SonarQube pros

"The most valuable features of Synopsys API Security Testing are the metrics, results, and threat vectors that it shares."

Cons

"During the setup process, we only had one issue related to the number of available files. To perform the analysis, you have quite a lot of available file handles, so we had to increase that limit."

"There could be better integration with other products."

"Currently requires multiple tools, lacking one overall tool."

"The tool needs to be more compatible with C/C++ language"

"New plug-ins should be integrated into SonarCloud to give more flexibility to the product."

"SonarQube could be improved with more dynamic testing—basically, now, it's a static code analysis scan. For example, when the developer writes the code and does the corresponding unit test, he can cover functional and non-functional. So the SonarQube could be improved by helping to execute unit tests and test dynamically, using various parameters, and to help detect any vulnerabilities. Currently, it'll just give the test case and say whether it passes or fails—it won't give you any other input or dynamic testing. They could use artificial intelligence to build a feature that would help developers identify and fix issues in the early stages, which would help us deliver the product and reduce costs. Another area with room for improvement is in regard to automating things, since the process currently needs to be done manually."

"An improvement is with false positives. Sometimes the tool can say there is an issue in your code but, really, you have to do things in a certain way due to external dependencies, and I think it's very hard to indicate this is the case."

"One thing to improve would be the integration. There is a steep learning curve to get it integrated."

More SonarQube cons

"The solution required us to use our team and we spoke to Synopsys API Security Testing's support to do the implementation. We use two people from our team for the implementation. and one person for maintenance."

Pricing and Cost Advice

"SonarQube enterprise, I am not sure of the price but from what I understand they are charging a fee. It's is not clear if it is an annual fee or a one-off."

"Compared to similar solutions, SonarQube was more accessible to us and had more benefits, with regards to size of the code base and supported languages. Apart from the Enterprise licensing fee, there are no additional costs."

"For the Community edition, there is no extra cost. It's totally free. The Enterprise edition, Data Center edition, and Developer edition are the paid versions."

"It's a bit expensive for us. The currency rate of the dollar is a problem but it may be fine for other countries."

"On the pricing side, it's 3,000 Euros for 1 million lines of code."

"My guess is that we have a yearly subscription. We use it quite extensively, so a monthly license wouldn't make sense. Yearly subscriptions are usually cheaper. In addition to the standard licensing fee, there is just the cost of running the hardware where it is hosted."

"We use the free version; there are no hidden costs or licensing required."

"It's an open-source product."

More SonarQube pricing and cost advice

Information not available

See which vendors are best for you

Use our free recommendation engine to learn which Static Application Security Testing (SAST) solutions are best for your needs.

See recommendations

800,688 professionals have used our research since 2012.

Top Industries

By visitors reading reviews

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

13%

Government

Computer Software Company

24%

Financial Services Firm

19%

Manufacturing Company

12%

Insurance Company

10%

Company Size

By reviewers

Large Enterprise

Midsize Enterprise

Small Business

No data available

Questions from the Community

Is SonarQube the best tool for static analysis?

I am not very familiar with SonarQube and their solutions, so I can not answer. But if you are asking me about which tools that are the best for for Static Code Analysis, I suggest you have a look...

See all answers

Which gives you more for your money - SonarQube or Veracode?

SonarQube is easy to deploy and configure, and also integrates well with other tools to do quality code analysis. SonarQube has a great community edition, which is open-source and free. Easy to use...

See all answers

How would you decide between Coverity and Sonarqube?

We researched Coverity, but in the end, we chose SonarQube. SonarQube is a tool for reviewing code quality and security. It helps to guide our development teams during code reviews by providing rem...

See all answers

Ask a question

Earn 20 points

Comparisons

Checkmarx One vs SonarQube

Compared 19% of the time

SonarCloud vs SonarQube

Compared 13% of the time

Coverity vs SonarQube

Compared 12% of the time

GitHub Advanced Security vs SonarQube

Compared 9% of the time

Veracode vs SonarQube

Compared 9% of the time

More SonarQube Competitors

Seeker vs Synopsys API Security Testing

Compared 74% of the time

OWASP Zap vs Synopsys API Security Testing

Compared 26% of the time

More Synopsys API Security Testing Competitors

Product Reports

Buyer's Guide

SonarQube

August 2024

Download SonarQube product report

Buyer's Guide

Static Application Security Testing (SAST)

August 2024

Download Synopsys API Security Testing product report

Also Known As

Sonar

No data available

Learn More

Sonar

Synopsys

Interactive Demo

Sonar

Demo not available

Synopsys

Overview

SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating seamlessly with the top DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of your release pipeline, displaying pass/fail results for new code based on quality profiles you customize to your company standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production.

At its core, SonarQube includes a static code analyzer that identifies bugs, security vulnerabilities, hidden secrets, and code smells. The platform guides you through issue resolution, fostering a culture of continuous improvement. SonarQube’s comprehensive reporting is a valuable tool for dev teams to monitor their codebase's overall health and quality across multiple projects in their portfolio. With SonarQube, you can achieve a state of Clean Code, leading to secure, reliable, and maintainable software.

Sonar is the only solution combining the power of industry-leading software quality analysis with static application security testing (SAST) and real-time coding guidance in the IDE (with SonarLint) to meet the DevOps and DevSecOps demand of putting agility, automation, and security in the hands of developers. Further accelerate DevOps continuous integration by helping developers find and fix issues in code before the software testing stage, reducing the churn of finding, fixing, rebuilding, and retesting your app.

With over 5,000 Clean Code rules, SonarQube analyzes 30+ of the most popular programming languages, including dozens of frameworks, the top DevOps platforms (GitLab, GitHub, Azure DevOps, and Bitbucket, and more), and the leading infrastructure as code (IaC) platforms.

SonarQube is the most trusted static code analyzer used by over 7 million developers and 400,000 organizations globally to clean over half a trillion lines of code.

AppSec testing optimized for the needs of API developers
APIs provide open, flexible interfaces that enable applications and services to talk to each other. But these characteristics can also make it difficult to build secure software—and even more difficult for traditional AppSec tools to test it.

Sample Customers

Information Not Available

Buyer's Guide

Static Application Security Testing (SAST)

August 2024

Download Free Report

Find out what your peers are saying about Sonar, Veracode, Checkmarx and others in Static Application Security Testing (SAST). Updated: August 2024.

DOWNLOAD NOW

800,688 professionals have used our research since 2012.

See our list of best Static Application Security Testing (SAST) vendors.

We monitor all Static Application Security Testing (SAST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.