SonarQube

software

★★★★½4.4(400 reviews)

About

Self-managed code quality and security analysis platform. Performs static analysis to detect bugs, vulnerabilities, and code smells across 30+ programming languages.

Overview

SonarQube is the leading code quality and security analysis platform, providing continuous inspection of code to detect bugs, vulnerabilities, and code smells. Its integration into CI/CD pipelines makes it essential for teams prioritizing code quality at scale.

code-quality sast static-analysis security devops sonarqube

Pros

+Industry standard for code quality
+Rich rule set
+Self-hosted (data stays on premises)
+Community edition is free

Cons

-Self-hosted requires maintenance
-UI feels dated
-Can be slow on large codebases
-Advanced features require paid edition

Visit website

This may be an affiliate link — the creator and GuruStacks may earn a commission, at no extra cost to you. Learn more

Details

Typesoftware

Pricing

Model

open source

Platforms

weblinuxmacwindows

Community

Creator reviews

No creator reviews yet

Community

Listed in Stacks

SaaS Developer

The complete developer toolkit for building, shipping, and scaling SaaS products — from code editors and CI/CD to payments, monitoring, and AI-powered development tools.

by Gurustacks0

DevOps Engineer Stack

Comprehensive DevOps engineering tools and platforms for CI/CD, infrastructure automation, monitoring, and cloud operations

by Gurustacks0

Similar tools

View alternatives →

Codiga

4.4

code analysissecuritysast

Real-time static code analysis tool that detects security vulnerabilities and coding issues across IDEs and CI/CD pipelines with customizable rules.

CodeThreat

Unrated

code-analysissecuritydevelopment

AI-powered static code analysis that detects vulnerabilities with minimal false positives while integrating directly into development pipelines.

Checkov

4.4

infrastructure-as-codesecuritypolicy-as-code

Policy-as-code static analysis tool that scans IaC configurations across Terraform, CloudFormation, and Kubernetes for security misconfigurations.

Slither

4.2

securitystatic-analysissolidity

Static analysis framework for Solidity smart contracts detecting vulnerabilities and code quality issues

HoundDog

Unrated

data-leak-preventionsecuritycode-analysis

Static code scanner that detects and prevents sensitive data leaks.

Corgea

Unrated

debuggingsecuritydevops

AI tool that automatically generates security patch suggestions for vulnerable code identified by SAST and SCA scanning tools.

Is this your tool? Claim this listing