Back to all tools
SonarQube
Catch bugs and vulnerabilities before they reach production.
0Open Source
Security Code Quality
Overview
An open-source platform for continuous inspection of code quality to perform automatic reviews with static analysis.
Key Features
- Static analysis for 30+ programming languages
- Detects bugs, code smells, and security vulnerabilities
- Quality Gates to enforce standards before merging
- PR decoration with inline comments on issues found
- Technical debt tracking and remediation guidance
- OWASP Top 10 and CWE vulnerability categorisation
Real-World Workflows
Shift-left security in a CI/CD pipeline
- 1Run sonar-scanner in the CI pipeline after unit tests pass
- 2SonarQube analyses the code and posts results to its dashboard
- 3Quality Gate checks pass/fail based on new code coverage and issue thresholds
- 4Pipeline fails and PR is blocked if the Quality Gate fails
- 5Developers fix issues locally using SonarLint IDE plugin before pushing
Tracking technical debt across a monorepo
- 1Configure multi-module analysis with sonar-project.properties
- 2Run analysis on every merge to main to track debt over time
- 3Use portfolio view to compare quality across all projects
- 4Set long-term quality targets and monitor progress in dashboards
Getting Started
docker run -d --name sonarqube \ -p 9000:9000 sonarqube:community # Visit http://localhost:9000 (admin/admin) # Then run: sonar-scanner -Dsonar.projectKey=my-project
Compare Alternatives
See how SonarQube stacks up against similar tools.