SonarQube
Ranked #4 in Open-source application security testing tools, and on 3 more rankings.
SonarQube is a software at PO Box 765, CH-1215, Geneva, Switzerland.
An automated code review tool that systematically checks code health across multiple programming languages.
At a glance
| Address | PO Box 765, CH-1215, Geneva, Switzerland |
| Price from | 150 USD per year |
| Best for | Enterprise teams requiring comprehensive security gating |
From SonarQube's own website.
Company facts
| Founded | 2008 |
| Headquarters | Geneva, Switzerland |
| Social profiles | LinkedIn, X, Facebook, YouTube |
Facilities and features
Its website also mentions:
- Published pricing
- Integrations
What stands out
The product finds bugs and vulnerabilities across 30+ languages on every pull request.
“Finds bugs, vulnerabilities, and security hotspots across 30+ languages on every pull request.”SonarQube, own website
The product automatically generates code fix suggestions to minimise manual debugging.
“Automatically generate code fix suggestions with a click, minimizing manual debugging.”SonarQube, own website
Worth knowing
- Can be resource heavy during large scans
How it ranks
SonarQube is ranked 4th of 10 in Open-source application security testing tools (Lister Score 90.0), 5th of 10 in Best code quality tools (Lister Score 90.0), 6th of 10 in Enterprise code quality tools (Lister Score 90.0) and 7th of 10 in Best application security testing tools (Lister Score 90.0).
#4 in Open-source application security testing tools · Lister Score 90.0
SonarQube is a comprehensive code verification platform for CI/CD workflows. It provides multi-layered review of all code with consistent and auditable findings.
Finds bugs and vulnerabilities across thirty languages on every pull request.
How the score is made up: fit to this ranking's criteria 40; evidence on its own site 20; how complete its published information is 18; buying information on its own site 12.
“SonarQube Advanced Security Secure use of open source code with advanced SAST and SCA”SonarQube, own website
“Anchored on our open core principle, we carry a commitment to transparency, security, and continuous improvement of our Open Source solution.”SonarQube, own website
| Rank | Open-source application security testing tools | Score |
|---|---|---|
| 1 | Mend.io | 94.0 |
| 2 | ReversingLabs | 94.0 |
| 3 | Snyk | 94.0 |
| 4 | SonarQube | 90.0 |
| 5 | Wazuh | 88.0 |
| 6 | Aqua | 84.0 |
| 7 | SpecterOps | 84.0 |
| 8 | Metasploit | 80.0 |
| 9 | Bandit | 74.0 |
| 10 | Gitleaks | 68.0 |
#5 in Best code quality tools · Lister Score 90.0
SonarQube is a comprehensive code verification platform for CI/CD workflows. It provides multi-layered review of all code with consistent and auditable findings.
Finds bugs and vulnerabilities across thirty languages on every pull request.
How the score is made up: fit to this ranking's criteria 40; evidence on its own site 20; how complete its published information is 18; buying information on its own site 12.
“Improve quality, reliability, and security through automated, explainable, compliant code review.”SonarQube, own website
| Rank | Best code quality tools | Score |
|---|---|---|
| 1 | Codacy | 98.0 |
| 2 | CodeScene | 96.0 |
| 3 | CodeRabbit | 92.0 |
| 4 | DeepSource | 92.0 |
| 5 | SonarQube | 90.0 |
| 6 | Parasoft | 84.0 |
| 7 | Perforce Helix Core | 84.0 |
| 8 | Qodo | 84.0 |
| 9 | ESLint | 82.0 |
| 10 | IAR | 80.0 |
#6 in Enterprise code quality tools · Lister Score 90.0
It is a comprehensive zero trust code verification platform. It provides multi-layered review of all code with consistent and auditable findings.
Generates code fix suggestions to minimise manual debugging.
How the score is made up: fit to this ranking's criteria 40; evidence on its own site 20; how complete its published information is 18; buying information on its own site 12.
“Code quality, security, and AI code review on one platform.”SonarQube, own website
“Over 50 developers one conversation, whole platform. Custom pricing”SonarQube, own website
| Rank | Enterprise code quality tools | Score |
|---|---|---|
| 1 | Codacy | 98.0 |
| 2 | CodeScene | 96.0 |
| 3 | CodeRabbit | 92.0 |
| 4 | DeepSource | 92.0 |
| 5 | Semgrep | 92.0 |
| 6 | SonarQube | 90.0 |
| 7 | Qodo | 86.0 |
| 8 | Parasoft | 84.0 |
| 9 | Deno | 80.0 |
| 10 | Eiffel Software | 74.0 |
#7 in Best application security testing tools · Lister Score 90.0
SonarQube is a comprehensive code verification platform offering multi-layered review. It provides findings that are consistent, explainable, repeatable, and auditable.
Offers a free IDE extension providing on-the-fly analysis and coding guidance.
How the score is made up: fit to this ranking's criteria 40; evidence on its own site 20; how complete its published information is 18; buying information on its own site 12.
“SonarQube Advanced Security Secure use of open source code with advanced SAST and SCA”SonarQube, own website
| Rank | Best application security testing tools | Score |
|---|---|---|
| 1 | Snyk | 96.0 |
| 2 | Mend.io | 94.0 |
| 3 | AppKnox | 92.0 |
| 4 | Semgrep | 92.0 |
| 5 | Contrast Security | 90.0 |
| 6 | Invicti | 90.0 |
| 7 | SonarQube | 90.0 |
| 8 | Probely | 88.0 |
| 9 | StackHawk | 88.0 |
| 10 | Veracode | 88.0 |
Frequently asked questions
Where is SonarQube?
SonarQube is at PO Box 765, CH-1215, Geneva, Switzerland.
How does SonarQube rank on Lister?
SonarQube is ranked 4th of 10 in Open-source application security testing tools (Lister Score 90.0), 5th of 10 in Best code quality tools (Lister Score 90.0), 6th of 10 in Enterprise code quality tools (Lister Score 90.0) and 7th of 10 in Best application security testing tools (Lister Score 90.0).