SonarQube

Open source

Static analysis platform that inspects code for bugs, vulnerabilities, and code smells across many languages.

by SonarSourceOfficial site ↗Source code ↗

Pricing: free, subscription, usage
Free tier: true
License: open-source, proprietary
Open source: Yes

Editorial review

SonarQube has not yet been editorially reviewed. User reviews and published field data below are unaffected — we say so rather than implying an editorial verdict.

Facts & attributes

Every value carries its evidence state. “—” means unknown — never a silent default (P-02).

Identity · Taxonomy

Documentation(HTTPS URL): https://docs.sonarsource.com/Verified
Tags(open-source;cloud-native): static-analysis, code-quality, devsecops, ci-cd, ai-code-reviewVerification pending

Platform · Deployment

Delivery model(SaaS;self-hosted;desktop;mobile;embedded;managed-cloud;appliance): SaaS, self-hostedVerified

Pricing · Licensing

Free plan(true/false): trueVerification pending
Free trial(true/false): trueVerification pending
License model(proprietary;open-source;source-available;dual-license): open-source, proprietaryVerification pending
Pricing model(free;subscription;usage;seat;asset;transaction;revenue-share;perpetual;custom): free, subscription, usageVerification pending
Source repository(HTTPS URL): https://github.com/SonarSource/sonarqubeVerified
SPDX license IDs(Apache-2.0;MIT): LGPL-3.0Verified
Starting price(29): 34Verified
Trial length(14): 14Verified

Features · Product · Fit

Core capabilities(authoring;automation;analytics): Automated code review across 45+ languages, SAST and taint analysis, Secrets detection, Software composition analysis (SCA) with SBOM, Quality gates with auditable evidenceVerification pending

Api · Integrations · Ecosystem

API available(true/false): trueVerification pending
CLI(true/false): trueVerification pending
Enterprise SSO(SAML;OIDC): SSO, SCIMVerified

Support · Docs · Services

Support channels(email;ticket;chat;phone;community): community forum, commercial supportVerification pending

Audience · Use · Case

Best for(Neutral editorial summary): Teams automating code quality and security verification across 45+ languages in IDE, PR and CIVerification pending
Company-size fit(individual;SMB;mid-market;enterprise): individual, SMB, mid-market, enterpriseVerification pending
Primary use cases(build;monitor;automate): code quality and bug detection, developer-led security (DevSecOps), AI code review and compliance reportingVerification pending
Skill level(beginner;intermediate;advanced;specialist): intermediateVerification pending

Vendor · Maintainer

Vendor type(commercial;foundation;community;government;consortium;individual): commercialVerified

User reviews

Review policy

No published reviews yet.