SonarQube Server (formerly SonarQube) Reviews

Name: SonarQube Server (formerly SonarQube)
Brand: Sonar
Rating: 4 (113 reviews)

Vendor: Sonar

4.0 out of 5

113 reviews
81% willing to recommend

3,599 followers

Post review

What is SonarQube Server (formerly SonarQube)?

SonarQube Server enhances code quality and security via static code analysis. It detects vulnerabilities, improves standards, and reduces technical debt, integrating into CI/CD pipelines.

Get the SonarQube Server (formerly SonarQube) Buyer's Guide and find out what your peers are saying about SonarQube Server (formerly SonarQube), Veracode, GitLab and more!

SonarQube Server (formerly SonarQube) is the #1 ranked solution in application security solutions, AST tools, and top Software Development Analytics solutions. PeerSpot users give SonarQube Server (formerly SonarQube) an average rating of 8.0 out of 10. SonarQube Server (formerly SonarQube) is most commonly compared to Veracode: SonarQube Server (formerly SonarQube) vs Veracode. SonarQube Server (formerly SonarQube) is popular among the large enterprise segment, accounting for 70% of users researching this solution on PeerSpot. The top industry researching this solution are professionals from a financial services firm, accounting for 17% of all views.

Buyer's Guide

SonarQube Server (formerly SonarQube)

October 2024

Get the report

Helped 814,528 peers since 2012

Featured reviews

Wang Dayong

Senior Software Engineering Manager at Hill

We use the product to review our software codes. We have integrated the product to review our new delivery code When we deliver a code, the solution scans the code and reports whether the code has bugs or any other vulnerability issues. Thus the solution helps us identify issues and improve the…

Read full review

Devid William

Application Security Coordinator at Banco Votorantim

I work on vulnerability management. I use the security features in SonarQube. I also use Veracode. I use both solutions to verify each other’s results We see the security issues in our solutions with the help of the product. It helps us improve the solutions. There are many options and examples…

Read full review

Jaile Sebes

Senior Software Architect at Siemens Industry

I integrate SonarQube into my CI/CD pipeline by running it during the build process for static code analysis. Once the analysis is complete, the results are sent to the dashboard for easy monitoring and tracking of code quality. Using SonarQube for security vulnerability detection offers several benefits such as comprehensive security rule coverage and integration with the dashboard for easy monitoring. Additionally, SonarQube provides features like password handling, eliminating the need for separate tools and enhancing overall code security. SonarQube handles false positives during code analysis by allowing teams to review and exclude them, especially in long-term projects where patterns are familiar. While false positives may occur, experienced teams can easily identify and manage them, ensuring accurate analysis results. For software development, especially in Java-based environments, I highly recommend using SonarQube due to its effectiveness in ensuring code quality and minimizing potential issues. While there are free tools available, SonarQube's comprehensive support for various languages and its benefits make it a valuable choice for developers. Overall, I would rate SonarQube as an eight out of ten.

Read full review

SonarQube Server (formerly SonarQube) mindshare

Product category:

As of November 2024, the mindshare of SonarQube Server (formerly SonarQube) in the Application Security Tools category stands at 26.7%, down from 27.7% compared to the previous year, according to calculations based on PeerSpot user engagement data.

Application Security Tools

Key learnings from peers

Last updated Oct 30, 2024

Valuable Features

SonarQube Server's most valuable features include multi-language support, customizable quality gates, seamless Jenkins integration, and a user-friendly dashboard. It provides deep code analysis, detects security vulnerabilities effectively, and enhances code quality through automated static analysis. The tight integration with development pipelines offers comprehensive reporting, allowing teams to manage coding standards efficiently. Its open-source model supports a broad community, while the ability to define custom rules and track technical debt assists in maintaining consistent code quality.

"SonarQube's unit test coverage and exhaustive information at the module, project, and overall code repo levels are quite good."
"Offers multi-programming language support"
"Any developer can easily identify issues using the process flow or steps provided by SonarQube. In terms of integration, SonarQube makes it quite easy, simplifying the steps for users."

Room for Improvement

SonarQube Server faces challenges with security features, false positives, and limited support for certain languages and integrations. Users express a need for better API documentation, improved interfaces, and enhanced automation capabilities. Complexity in integrating multiple tools, issues with update processes, and the requirement for more customizable scanning rules are areas highlighted for improvement. There is also a call for dynamic scanning, better handling of external libraries, and more comprehensive reports.

"Depending on the tool's configuration, sometimes you get false alarms that are unimportant to you."
"The tool needs to be more compatible with C/C++ language"
"In terms of analysis and findings, other tools provide more in-depth insights and detailed steps to mitigate or handle issues."

ROI

SonarQube Server reduces team effort in identifying code issues and enhances code quality and security. Users report positive ROI, finding vulnerabilities and improving stability. Though ROI is hard to quantify, better code is created with fewer defects over years of use. Users integrate it with tools like Jenkins, tracking metrics for fewer defects. The analysis engine needs improvement for better flaw detection, yet it effectively finds vulnerabilities, minimizing rework and improving code quality.

Pricing

SonarQube offers both free and paid versions, with many users finding the free open-source version sufficient for basic needs. Costs mainly arise from hosting, deployment, and commercial plugins. The paid Developer and Enterprise editions provide enhanced features and support, with costs varying based on codebase size. Licensing is generally seen as reasonable, with some suggesting that prices could be more competitive compared to other solutions. Self-hosting on existing infrastructure can be cost-efficient for larger organizations.

"SonarQube is a cost-effective solution."
"We use the solution free of cost."
"The tool's pricing is reasonable."

Popular Use Cases

SonarQube Server (formerly SonarQube) assists users in improving code quality by identifying issues related to bugs, vulnerabilities, and security. It is integrated into CI/CD pipelines for automating static code analysis. Users apply it to enhance code standards, reduce technical debt, and ensure security compliance. It provides immediate feedback on code, aiding developers in maintaining clean, well-structured, and secure codebases across various programming languages.

Service and Support

SonarQube Server's customer service is dependable, with robust community forums and extensive documentation. Many users rely on the community for guidance, finding online resources sufficient. Technical support is effective, particularly for paid versions, though some find response times lacking and support costly. Users value the active community and comprehensive documentation, achieving their needs without frequent direct assistance. Technical support receives mixed feedback, highlighting the importance of support packages for enhanced service levels.

Deployment

SonarQube Server's initial setup is largely straightforward, aided by good documentation. While some encounters complexities with specific integrations or scalability adjustments, many find it easy to install with minimal resources needed. Common themes point to a simple deployment process, often completed within hours or days. Some setups benefit from automation tools like Docker or Jenkins, and despite initial learning curves, users report a manageable adaptation period.

Scalability

SonarQube Server demonstrates good scalability, with no significant issues encountered. Most users experience seamless integration into their setups, handling multiple code bases and user numbers effectively. Some report increased resource needs with larger setups, particularly with physical machines. A few see performance drop under extensive loads. Despite some limitations, especially in the Community Edition, organizations with varied user bases find SonarQube Server to be scalable with adequate configuration and deployment.

Stability

SonarQube Server showcases high stability with generally few issues. Some common configuration challenges arise, but these are typically attributed to infrastructure or third-party plugins. Users often note its reliable performance, although occasional connectivity or resource constraints are mentioned. Users appreciate its improvement in newer versions and consider it mature and stable. Various departments utilize it effectively for daily tasks, underscoring its consistent reliability. Although some rate it slightly lower, it's acknowledged as a stable choice.

These insights are based on the in-depth reviews provided by peers to help you make a better buying decision.

Download our SonarQube Server (formerly SonarQube) Buyer's Guide for additional reliable information.

Review data by company size

By reviewers

By visitors reading reviews

Top industries

By visitors reading reviews

Financial Services Firm

17%

Computer Software Company

15%

Manufacturing Company

13%

Government

Insurance Company

Retailer

Healthcare Company

Energy/Utilities Company

Educational Organization

University

Comms Service Provider

Media Company

Construction Company

Real Estate/Law Firm

Non Profit

Transportation Company

Hospitality Company

Legal Firm

Logistics Company

Wholesaler/Distributor

Outsourcing Company

Pharma/Biotech Company

Aerospace/Defense Firm

Recreational Facilities/Services Company

Engineering Company

Consumer Goods Company

Performing Arts

Compare SonarQube Server (formerly SonarQube) with alternative products

Learn more about SonarQube Server (formerly SonarQube)

SonarQube Server is a comprehensive tool for enhancing code quality and security. It offers static code analysis to identify vulnerabilities, improve coding standards, and reduce technical debt. By integrating into CI/CD pipelines, it provides automated checks for adherence to best practices. Organizations use it for code inspection, security testing, and compliance, ensuring development environments with better maintainability and fewer issues.

What are the key features of SonarQube Server?

Support for 20+ languages: Extensive programming language support suitable for diverse coding environments.
Custom coding rules: Allows for tailored rule sets to match specific coding standards.
Flexible quality gates: Define criteria for code acceptance at various intervals.
CI/CD integration: Seamless integration with Continuous Integration/Continuous Deployment tools.
Rich interface: User-friendly dashboard with detailed visual insights.

What benefits should users expect from SonarQube Server?

Improved code quality: Enhanced analysis contributes to fewer bugs and improved coding practices.
Security enhancements: Identifies and mitigates security vulnerabilities pre-emptively.
Maintainability: Reduces technical debt, yielding long-term development efficiency.
Customizable: Flexibility in configuration aligns with specific project needs.

Many industries implement SonarQube Server to uphold coding standards, maintain security protocols, and streamline their software development lifecycle. In sectors like finance and healthcare, adhering to regulations and ensuring reliable software is critical, making SonarQube Server invaluable. It is often integrated into CI/CD pipelines, ensuring that code changes meet set standards before deployment. This approach enhances productivity and maintains compliance with industry-specific requirements.

SonarQube Server (formerly SonarQube) was previously known as Sonar.