SonarQube Server Reviews & Insights

Score9.5 out of 10

94 Reviews and Ratings

Community insights

TrustRadius Insights for SonarQube Server are summaries of user sentiment data from TrustRadius reviews and, when necessary, third party data sources.

Pros

Efficient and Precise Code Quality Reports: Multiple users have praised SonarQube for its highly efficient and precise code quality reports. This feature has allowed them to gain a comprehensive understanding of their code's quality, identify areas for improvement, and enhance the overall quality of their code.

Detection of Bugs and Vulnerabilities: Reviewers have found SonarQube's ability to highlight bugs and vulnerabilities in the codebase to be a valuable asset. This feature has helped them identify potential issues early on, enabling them to take proactive measures to improve the code's quality and security.

Valuable Code Remediation Suggestions: Many users have expressed appreciation for SonarQube's suggestions for code remediation and resolution. These suggestions have proven extremely valuable in helping them make their code cleaner, more maintainable, and ultimately improving long-term code quality.

Reviews

35 Reviews

SonarQube Experience

Rating: 10 out of 10

August 26, 2024

Use Cases and Deployment Scope

It is one of the components within the gateway to get products into production. We have over 700 projects and just over 20m lines of code.

We have been using it since 2018.

We focus currently on vulnerabilities with required gates and stepped options with temporary "get well plans". The more advanced teams are focusing on quality aspect and self-manage their maturity. But there is currently no hard lines for quality at this time except for team agreed upon minimum complexity and duplication standards on new code.

Regarding helm charts and kubernetes... this was long awaited and welcomed! Making our deployments easier. Concern was on testing and such, there was a mistep in the last 10.6.0 push which caused a slight concern, but SonarSource was very quick at getting 10.6.1 out and distributing the information.

The only other concern we had, that we hadn't experienced in that past (at least not like this), the change of JDKs at minor versions, scanners, linters, especially without backwards compatibility where pipelines must actively change from JDK 11 to JDK 17 might be tough for groups who have large amounts of pipelines. **Pipelines which support templates that inject SAST requirements help a bunch to reduce the scope of pipeline changes, but still caught us by surprise. This sort of change is expected at major versions, right... But still, very stable... this hiccup didn't sway our thoughts about the product overall.

We're still trying to figure out how we can reduce costs... although value is very tangible tangible to some, the significant overhead is often questioned. Prompts us into discussions that force decisions on which code bases to remove, even if temporarily, for code that is relatively static for long periods.

We really appreciate the engagement of the SonarSource Community site. We use it to stay informed and to get quick insights and responsive support. Great folks out there--appreciate them and the engagement and they represent SonarSource well.

Pros

community engagement
stability
documentation is improving
samples/examples are improving

Cons

helm charts stability
minimize breaking changes on minor builds--incl scanners, linters

Likelihood to Recommend

Updates of vulnerabilities and hotspots.

Verified User

Engineer in Information Technology (10,001+ employees)

Vetted Review

6 years of experience

SonarQube: The mandatory tool to elevate your code quality quality

Rating: 10 out of 10

Incentivized

February 6, 2023

Use Cases and Deployment Scope

We use SonarQube to analyze our codebase, the main goals are detection of code smells, security vulnerabilities, and performance issues, also to measure our test coverage. It is part of the continuous integration process. We perform analysis in different languages like Java, JavaScript, Typescript, and Python. We are planning to include new ones, like scala and PHP.

Pros

Code complexity detection
Code smell detection
Provides good default rules
Huge language support
Easy setup
Easy integration with common build tools
Great fix proposals, and issues description

Cons

It doesn't provide automatic pull request with fixes
It doesn't provide insights about the libraries of the projects
The administration management user interface could be simplified
It doesn't provide an order to fix issues, like archives with more and frequent commits have top priority

Likelihood to Recommend

- The SonarQube analysis provides good suggestions to improve our project's health
- The default rules "Sonar Way" are pretty good and provide good insights
- I consider it a mandatory tool for any serious project.
- You can use offline tools like error-prone, spotbugs, or PMD, but Sonar analysis is more complete and it has more features.

Verified User

Technician in Engineering (201-500 employees)

Vetted Review

3 years of experience

Code Quality is a Must!

Rating: 9 out of 10

Incentivized

February 3, 2023

Use Cases and Deployment Scope

We use SonarQube as part of the CICD pipeline running on Azure DevOps. Mostly .Net projects, and currently integrating with react native.

Pros

Ongoing code quality management
Increase developer skills.
Detect and report problems.
Scale with business needs
Optimize the quality
it is sustainable

Cons

The main “disadvantage” is code maintenance, being more expensive, it also takes more time, as well as producing “false positives”.

Likelihood to Recommend

SonarQube allows automatic static analysis of source code, looking for patterns with errors, bad practices or incidents.
In addition, it performs a calculation of the technical debt. It can be used in any scenario.
In order to use SonarQube, you need to install a server component, where the engine that performs the analysis and stores the results is located, and the analysis must be invoked in some way, which can be done with a client called SonarQube Scanner.
You can also integrate the analysis into the IDE you are using, with a plugin called SonarLint!.

Ariel Cabeza

Tech Lead in Information Technology at Andreani Grupo Logístico (5001-10,000 employees)

Vetted Review

4 years of experience

View profile

Sonarqube - The ultimate tool for end to end code analysis

Rating: 9 out of 10

Incentivized

February 1, 2023

Use Cases and Deployment Scope

SonarQube is the default choice for static analysis tools for all the projects in our organization. We use it extensively for examining code quality, detect code smells, detect security issues in code and identify complexities in code for every project. SonarQube is extremely useful since it works for almost all languages that we write our code in, including python and Java. The plugin based framework ensures extensibility and easy enhancement of functionality for new usecases.

Pros

Easy integration with all coding languages
Plugin integration ensures easy extensibility
Detects code smells and vulnerabilities
Generate test coverage reports
Custom quality gates to ensure no bad code is merged

Cons

Learning curve is steep
Report generation is often very time consuming
Works particularly well for Java, but not so good for Python and R
Initial setup is quite complicated

Likelihood to Recommend

You should buy: If you need static analysis for multiple languages in your teams If static analysis integration with IDEs is an important requirement If you need custom quality gates for code quality analysis If highly detailed test coverage reports is important for your organization Do not buy if you cannot afford a dedicated team to manage the SonarQube instance for your organization

Verified User

Engineer in Engineering (1001-5000 employees)

Vetted Review

3 years of experience

SonarQube, you don't need to search more!

Rating: 8 out of 10

Incentivized

January 26, 2023

Use Cases and Deployment Scope

It's used as a quality gate for software development in the feature implementation, as well as a security barrier for bugs and good practices enforcer.

Pros

Easily setup quality gate for code analysis and tests.
Quick reports for vulnerabilities and good practices.
Easy setup of vulnerabilities level requirements.

Cons

Credentials manager, like managing users, groups and permissions is complex.
UI for code review can be improved, feels old but is useful nonetheless.
The ticket management system can also be improved.

Likelihood to Recommend

Sonarqube does its job properly, it can improve in some points like usability and user experience, but in the end, it does everything you need well.

Sérgio Cagica

Software Engineer at diconium (1-10 employees)

Vetted Review

3 years of experience

View profile

SonarQube- A perfect QC for Reviewers

Rating: 9 out of 10

Incentivized

January 24, 2023

Use Cases and Deployment Scope

We are a product based Company where we are using SonarQube to keep an eye on the Code quality of our all the projects. It really reduced the workload of the reviewers and helped a lot to improved our code quality and efficiency of the project. It helped us a lot where we can define our own set of rules in all the languages. It has helped us to identify the static code which reduced our deployment efforts.

Pros

You can set your own rules for almost all the languages
Most of the rules are already defined you just need to use them
It helps us on Security aspects too.
you can place a gate on Code coverage too.

Cons

UI part of reporting needs more improvement.
Simple tooltips can be there for the users to understand better instead of reading documents.
For report extraction in Excel or Pdf you need Enterprise version

Likelihood to Recommend

As we were having multiple projects in multiple languages to support our product, A team of 20 developers was working with the various level of experience. To maintain the code integrity and its Sanity SonarQube helped a lot to place the quality gates, Some of the rules were pre-defined and required very minor tweaking. It really made life easy for the reviewers as it supports multiple integration with gitlab, confluence and Jenkins.

Sayam Jain

Software Architect in Information Technology at ReliableSoft Technologies Pvt. Ltd. - India (11-50 employees)

Vetted Review

3 years of experience

View profile

SonarQube: Helper of Dev and organisation for better code quality and security practices.

Rating: 10 out of 10

Incentivized

January 20, 2023

Use Cases and Deployment Scope

As service based and product based organisation we are dealing with variety of products and projects so in order to maintain the Code Quality and also improve the coding structure by following the suggestions given by SonarQube Analysis and also checking the Code Coverage so we get to know that our code has fully passed through the Sonar Analysis. As a part of DevOps team we integrate SonarQube checks in CI(continuous integration part) so its an part of continuous code quality and we have also created custom Quality Gates in order to prevent the false or unimproved code from going into any environments.

Pros

Static Code Scanning
Code Coverage reports, User Friendly Dashboard
Integration with various tools in order to maintain code quality
Pre-built as well as Custom Quality Gates
Detect Bugs & Vulnerabilities, Review Security Hotspots, Track Code Smells
Also has many plugins to interact with

Cons

As in SonarQube community edition they should enable the after scanning report generation
other security reports like, vulnerability with preferred solution
Guide on scalability, backups, resiliency as well
small report type UI on other tools as well like Jenkins

Likelihood to Recommend

When we have a big projects/products and also there are multiple tech stacks involved in project and also there's an dedicated team working of multiple tech stack is working so there we need to ensure the uniformity in coding structures and also its has support for many languages out there in market. Its not suitable for small projects where the user base, internet traffic is not much. because in that use case we have more headache on maintaining SonarQube servers

Aman Makwana

DevOps Engineer in Engineering at Yudiz Solutions Pvt Ltd (201-500 employees)

Vetted Review

2 years of experience

View profile

Easy to use DecSecOps application

Rating: 8 out of 10

Incentivized

January 20, 2023

Use Cases and Deployment Scope

SonarQube is a freeware used for checking security vulnerabilities, inspection of automatic code quality checks and for CI/CD automation. In our organization we used this application as an integrated service plugin with Microsoft Azure's DevOps for CI/CD automation. It is very helpful application for inspection of applications developed using a variety of programming languages.

Pros

Automatic code analysis
Checking Security vulnerabilities
Easy integration with devops applications

Cons

Need more examples for different programming language codes
Better documentation

Likelihood to Recommend

Well suited:
- Easy to Integrate with different DevOps platforms for CI/CD automation
- To detect application security vulnerabilities
- For automation static code checks / analysis in order to detect bugs
- Can be used for variety of programming language applications
Improvement areas:
- Better documentation
- More programming language specific examples

Verified User

Engineer in Engineering (51-200 employees)

Vetted Review

1 year of experience

SonarQube - solid static code analysis tool

Rating: 7 out of 10

January 19, 2023

Use Cases and Deployment Scope

We use SonarQube in the software department in our devOps pipeline to analyze source code for our application and provide metrics on issues that it identifies within the codebase. Basically we'll run SonarQube at various steps of code check ins and merges as one of many metricsto determine code quality and alert the teams to potential issues in recently checked in codde that may need to be triaged and addressed.

Pros

Works well with .Net
Has a nice extension that allows us to run it in our IDE (visual studio)
Is customizable in the sense that you can write your own rule set that you want SonarQube to analyze the code against

Cons

Often it finds errors that aren't really errors that have impact, takes a lot of time to sort through those cases
It's a good screener, but by no means can it catch all bugs or be the sole predictor of code quality, so the metrics that it provides need to be caveated when reporting to leadership, etc

Likelihood to Recommend

Overall it's a nice check to incorporate into the devOps pipeline as another sanity check on the code that's being checked in and the codebase in general. It's good as a supplemental tool, but not if an org is looking for a complete view into code quality or security. Basically SonarQube is able to give you some flagged issues to look into and a metric that reflects the number of issues with the code it identifies, but still requires developers to take a second look and adequately triage which of the SonarQube issues are high impact and need to be addressed.

Verified User

Engineer in Research & Development (10,001+ employees)

Vetted Review

2 years of experience

Easy to use DevSecOps tool

Rating: 10 out of 10

Incentivized

January 19, 2023

Use Cases and Deployment Scope

We use SonarQube to scan our source code whenever we push changes to github. SonarQube helps in identifying code smells and security issues in the code with detailed explanation and intuitive reports.

Pros

code analysis
code smell detection
security issues with code
syntax highlighting for different languages

Cons

Setup steps can be explained a bit better

Likelihood to Recommend

Using docker, we were able to setup sonarqube and ran our first scan in about a day's time. It was quick to create different projects and linking source code to scan.
It clearly segregates issues under Reliability, Security and Maintainability buckets.
It also suggests solutions to fix issues with the code with up to date standards.

Prashant Chaudhari

Head of Engineering & Founding team member in Engineering at Jombay (51-200 employees)

Vetted Review

1 year of experience

View profile