Overall experience with
How helpful reviews are selected
Favorable Review
Product: SonarQube
SonarQube Simplifies Code Quality Checks But Requires Rule Fine-Tuning Efforts
Critical Review
Product: SonarQube
SonarQube Integrates Security in Development but Lacks Depth for Complex Needs
Likes and dislikes about
likes
SonarQube brings code quality and security checks into one place, making it easier to catch bugs, vulnerabilities and code smells for client codes. It also integrates well with CI/CD pipelines, which allows us to run automated scans even when the final tested code has not been frozen for testing without disruption. Dashboards are straightforward and provide enough context for us to quickly understand the issues and relay the same to the developers. Multiple language support is helpful in dealing with various tech stacks
April 30, 2026
dislikes
For more advanced / nuanced security scenarios, its depth of analysis and true security focused findings can sometimes fall short compared to dedicated enterprise-grade SAST solutions. While it's excellent for code quality and many OWASP Top 10 items, we've found it occasionally misses more subtle or complex vulnerabilities, or generates a higher rate of false positives for certain security patterns.
March 30, 2026
This service may contain translations provided by Google. Google disclaims all warranties related to the translations, express or implied, including any warranties of accuracy, reliability, and any implied warranties of merchantability, fitness for a particular purpose and noninfringement. Gartner's use of this provider is for operational purposes and does not constitute an endorsement of its products or services.