SonarCloud is overall a good tool for identifying code smells, bugs, and code duplication, but we've found that using Android Lint is more effective for our needs.
SonarQube Cloud (formerly SonarCloud) provides valuable reports, detecting vulnerabilities, security weak points, and hotspots with feedback directly to the feature branch. Deployment is easy with local installation options. Continuous analysis improves code quality with immediate reports. Recent support for mono reports and microservices enhances service detail. However, developers find it limited with inadequate container testing and false positives. Vulnerability detection is weaker than Veracode, requiring multiple products for comprehensive security.
