--- title: "SonarQube Reviews 2026. Verified Reviews, Pros & Cons | Capterra" description: "Is SonarQube the right Continuous Integration solution for you? Explore 76 verified user reviews from people in industries like yours to make a confident choice." source_url: "https://www.capterra.com/p/210481/SonarQube/reviews/" page_type: "reviews" language: "en" publication_date: "2026-10-21" --- SonarQube 4.5 (78) [View alternatives](https://www.capterra.com/p/210481/SonarQube/alternatives/) Provider data verified by our Software Research team, and reviews moderated by our Reviews Verification team. [Learn more](https://www.capterra.com/our-story/) * * * Last updated October 21st, 2026 # Reviews of SonarQube Ease of use 4.3 Customer Service 4.0 ## Pros and Cons in Reviews Swarnima G Software EngineerInformation Technology and Services, 501 - 1,000 employeesUsed the software for: More than 2 years. “That saves time and helps maintain cleaner code across projects.“ May 9, 2026 Swarnima G Software EngineerInformation Technology and Services, 501 - 1,000 employeesUsed the software for: More than 2 years. “Another small issue is that some warnings feel too strict or unnecessary, so developers still need to manually review results instead of trusting every suggestion directly.“ May 9, 2026 Swarnima G Software EngineerInformation Technology and Services, 501 - 1,000 employeesUsed the software for: More than 2 years. “The dashboard is detailed and gives a clear overview of code health.“ May 9, 2026 Daniel S Director of Research and DevelopmentHealth, Wellness and Fitness, 11 - 50 employeesUsed the software for: More than 2 years. “For example, if there are many commands in a Dockerfile, it will ensure that commands are merged together (but not necessarily correctly), which causes the dev to break the commands apart again. And the loop goes on until it is silenced.“ April 3, 2026 MP Michal P Software EngineerAccounting, 501 - 1,000 employeesUsed the software for: 1-2 years. “SonarQube is good at enforcing minimum code coverage on PRs“ February 28, 2025 ZR Zach R CEO OWnerComputer & Network Security, 11 - 50 employeesUsed the software for: 1-2 years. “It took them 2 months to resolve my request and they continued billing my card when the account was 100% not in use and I had no access to it. “ February 13, 2025 PJ Philip J IT specialistComputer Software, 11 - 50 employeesUsed the software for: Less than 6 months. “That´s reassuring“ June 30, 2026 PJ Philip J IT specialistComputer Software, 11 - 50 employeesUsed the software for: Less than 6 months. “False positives are annoying.“ June 30, 2026 ## Showing most helpful reviews Showing 1-25 of 78 available reviews Sort by: Most Helpful Rating Company Size Reviewer's Role Length of Use Frequency of Use Joshuva A. Cybersecurity Analyst Used the software for: 1-3 years ### "Solid SAST and quality gates, but plan limits leave gaps" November 4, 2026 4.0 It gives us code-level security checks we didn't get from periodic testing alone. Vulnerabilities and quality issues in active apps get caught and fixed earlier. Pros SAST, secrets detection and code quality (bugs, duplication) sit in one platform. Quality gates on onboarded repos catch issues on every push before code moves ahead. We compared it with the native scanning in GitHub, GitLab and Bitbucket, and Sonar still came out ahead for us. LOC counting is fair: it counts only the largest branch and leaves out test code, comments and blank lines. Cons Licensing is by lines of code, so on a smaller plan we can't keep every active repo onboarded. We scan, fix and remove repos to stay under the limit, and code pushed later to a removed repo goes unscanned. No SSO/SCIM, audit logs, IP allow-listing, SIEM log forwarding or downloadable compliance reports on the Team plan, so audit evidence is compiled by hand. SCA and SBOM only come with the Advanced Security add-on on Enterprise, so open-source dependency risk isn't covered on Team. Review Source R Reviewer Software Engineer Used the software for: 1-3 years ### "SonarQube automates code quality gates in our deployment pipelines" November 3, 2026 4.0 It provides great value for money by catching technical debt early. Initial setup takes effort, but their technical customer support is responsive when we need help troubleshooting runner configurations or IDE sync errors with SonarLint. Pros The vulnerability detection is excellent. Integrating it directly into our source code management pipeline like GitLab keeps our collaboration high by instantly blocking bad pull requests before they hit the main branch. Cons The learning curve for configuring custom quality gates is steep. We often hit weird bugs and issues where the scanner crashes due to memory limits on large Java repos. Review Source PJ Philip J. IT specialist Used the software for: Less than 1 year ### "The guardian I needed for my code" July 1, 2026 3.0 It´s fantastic, I´m calmer. I avoid unpleasant surprises and broken code in production. The investment is profitable Pros Detects vulnerabilities and serious issues before they reach production. Blocks bad code and prevents broken things from hitting the streets. That´s reassuring Cons False positives are annoying. Sometimes it flags things that aren´t really problems and you end up wasting time researching for nothing Review Source Verified Reviewer Software Engineer Used the software for: 3-5 years ### "Great tool for improving code quality" May 13, 2026 4.0 Pros What I liked most about SonarQube is how helpful it is for improving code quality and catching issues early in development. The vulnerability detection is one of its strongest features because it points out security risks, bugs, and code smells before they become bigger problems. It also integrates well with source code management and CI/CD pipelines, which makes it easier to include code analysis as part of the normal development workflow. That saves time and helps maintain cleaner code across projects. The platform has a bit of a learning curve in the beginning, especially when configuring rules and understanding reports, but after some use it becomes much easier to manage. The dashboard is detailed and gives a clear overview of code health. From a value for money perspective, it feels worth it for teams that care about code quality and security. It helps reduce issues before deployment, which can save a lot of time later. Cons One thing I liked least about SonarQube is that the initial setup can take time, especially when configuring quality rules and integrating it with existing workflows. It is not something that feels fully plug and play. Scans on bigger projects can also be a bit slow at times, which can affect development speed during heavy usage. Another small issue is that some warnings feel too strict or unnecessary, so developers still need to manually review results instead of trusting every suggestion directly. For new users, understanding all the settings and customization options can also take a while, so there is definitely a learning curve before getting the most out of the tool. Review Source Verified Reviewer Director of Research and Development Used the software for: 3-5 years ### "Smooth experience for code reviewers" April 6, 2026 4.0 Overall, it's made our team much more consistent and efficient.PRs are a smoother process because the code smells are already fixed. Pros It makes our team consistent. For example, one of our devs was notorious for PRs with high cognitive complexity in their functions. Now, all we need to do in our azure pipelines is ensure that all sonarqube code smells are solved before they can merge their work to main. Cons Sometimes it can create a loop in code smells. For example, if there are many commands in a Dockerfile, it will ensure that commands are merged together (but not necessarily correctly), which causes the dev to break the commands apart again. And the loop goes on until it is silenced. Review Source Enguerran M. Développeur Full Stack Used the software for: Less than 1 year 5.0 November 4, 2026 AI summary based on a full review SonarQube provides immediate benefits by preventing faulty code and security vulnerabilities from reaching production, acting as an automated gatekeeper. The pricing can increase significantly with larger codebases, which may impact the overall return on investment. Log in to unlock the full review, detailed ratings, and pros & cons Dimitri Alexander K. CTO Used the software for: 3-5 years ### "SonarCloud is a must have in your stack" August 8, 2022 5.0 It's still a good tool that help the dev teams to increase their knowledge in a specific language, it's still gives good indicator, overall it's still a good companion Pros It's free, as a Self hosted instance with sonarqube, and it's free for open source project. I like the advice they give that my IDE doesn't Cons It's a bit using a lot of RAM as it is written in Java Review Source Sachin S. DevOps Engineer Used the software for: Less than 1 year ### "Code Analysis and ensuing security against threats" May 25, 2022 5.0 Overall experience with Sonarqube is pretty wholesome integration came handy with my CI/CD tools such as Azure Devops and Jenkins. Provides insights against vulnerabilities and common threats so that necessary actions can be taken by developers to ensure the security and good coding practices to follow. Features like PR decoration allows to get results in CI/CD tools itself if passed then only commit happens to master branch. Pros Feature like Code Analysis and publishing those analysis report to end user. You can use default Quality Gates and Quality Profiles for scanning of your code. In case you want to modify these you can do that and define your own rule. Whenever there's commit in repo you just need to configure the task in your continuous integration pipeline if it passed the parameter only then commit will happens the master/main branch otherwise it will not. With these features you can eliminate the security threats and ensure that developers are following good practices while developing their code. I have integrated it with Azure DevOps. Cons Only thing which I can think can be improved is logging of events. Sometime it becomes hard to debug the issues. Other then that, I think over all this fulfills all the requirements. Review Source VR Verified Reviewer Undergraduate Student Used the software for: Less than 1 year ### "SonarQube is Great for Developers! " January 9, 2023 5.0 We could identify many code related issues that are presented in our code and improve the quality of the application that we are developing. As a overall, SonarQube tool is able to add a value to our applications. Pros It is simple for developers to recognize their code smells, unused lines of code, errors, problems with the third-party libraries they are using, etc. information and the precise location of the issue. It also offers answers to those problems. As a result, figuring out the problems and fixing them is simple. This will be a terrific tool for developers. Except that, we can introduce our own rules for checking the code quality. It could identify the code issues that are vulnerable to cyber attacks such as XSS, SQL Injection, etc. Cons It was difficult to use the SonarQube on-premise application. Once we pushed a new code section, the server needed to restart in order for the application to work. Review Source R Reviewer Technical Architect Used the software for: Less than 1 year ### "Essential tool for professional code delivery" September 12, 2022 5.0 SonarCloud improves software quality and developers' skills since it shows where the bugs and security hotspots are and how to correct them. Pros I use GitHub integration to run analysis on Pull Requests via GitHub workflows. Pull Request decoration is a great feature, it adds analysis results directly to GitHub PR's page. Cons SonarCloud reports also the code coverage by automated test, but it does not execute the report itself. You have to configure an external plugin (based on the nature of the project) that produces a report that SonarCloud can read and include in its dashboard and PR decoration. Review Source R Reviewer Developper Used the software for: 1-3 years ### "SonarCloud one of the cloud-based code quality and security analysis tools" May 5, 2023 3.0 Pros SonarCloud has a strong focus on security and compliance, with features such as vulnerability detection, security hotspots, and compliance reporting. Cons A potential drawback is the complexity of SonarCloud. While SonarCloud's comprehensive feature set can be a strength, it can also make the platform more challenging to use and configure Review Source Verified Reviewer Software Engineer II A Used the software for: 1-3 years ### "Best Code Quality check Tool" September 8, 2022 5.0 We are really taking help of SonarQUbe in maintaining code quality. Doing code scanning on each JIRA story completion. It also helps our developers to improve their code quality. Coding standards are better now. Reports are very useful. Pros 1\. Calculate the quality of code and also helps to improve the quality by providing the solution 2. Highlight the vulnerabilities , repetitive line of code 3. Developer Friendly tool as it provides recommendations on the line of code which needs an improvement. 4. Create Scan reports on demand 5. Option to add exception in code Cons 1\. Report Generation sometime take long time. 2. User Interface should be enhanced. 3. Lack custom rule set 4. As per cost, it is little bit expensive. Review Source Dono G. Head of QA Used the software for: 1-3 years ### "Good tool, easy to setup, cloud means limited in customisation" March 24, 2022 5.0 Overall it was great Pros Super easy to setup. Took literally minutes to do and then maybe another hour to tweak to fully operational. Gives community standard results very quickly. Cons The inability to add in some extra key scanners/rules is quite limiting. Review Source David Felipe C. VP of Engineering Used the software for: 3-5 years ### "Simple and powerful tool to improve your delivery process" October 31, 2022 4.0 We have more than 45 repos, and we practice continuous delivery, Sonar help us reduce the overhead by automating some tasks that previously were executed by a developer. They gain more control over their time, without sacrificing code quality Pros Helps my team to reduce time on checking several controls that are very standard in our projects, like code coverage, code smells, complexity, and security. Cons I used to like one functionality they had on the open source version (Sonarqube) in which the software commented the code directly on GitHub, helping the developer to notice their mistakes; I haven´t been able to use it again.Sometimes the configuration and customization are not very straightforward, and developers spend a lot of time trying to tune the tools. Review Source R Reviewer software engineer Used the software for: 3-5 years ### "Code Quality for just about Anything" June 28, 2022 4.0 We've seen a large increase in our code coverage and quality over the past two years of using SonarCloud. Some of our software had 0% coverage or less than 30% and a large majority of our code repositories have over 80% coverage now. Pros It tracks code quality over time. It does static analysis to look for duplicate code blocks, code smells, cyclomatic complexity, security issues, and more. It will also ingest code coverage reports to track test coverage over time. Integrates with GitHub (and other tools) so you can gate PR's based on the percent of code coverage and absence of flaws. We utilize it on mobile Xamarin projects, Kotlin projects, React web projects. It's a pretty mature product that has been around for a while. Its available in a free form, SonarQube, for you to test it out and run things locally. Static analysis helps ease the burden of code reviewers since it finds many common issues such as not null checking a parameter. It shoes metrics over time so you can see how your code base is improving over time. It basically automates code quality checking and metrics. Cons It can be a pain to set up your CI/CD pipeline to download and run all the necessary things to integrate with SonarCloud. It requires running some commands before you do a build and then some more after you do a build. SonarQube helps a lot with setting things up and testing your workflow locally though. Review Source R Reviewer Sr. Devops Used the software for: 3-5 years ### "A powerful tool for code quality" October 1, 2025 5.0 Overall, SonarQube is very powerful tool to catch bugs and potential security issues in order to improve our code quality even though setting it up can be a little bit of challenges at the beginning. Also you can customize rules like we set up rules to match what our project needs based on project's use-cases Pros We've been SonarQube many years for catching bugs and integrated with Github. It does provide very clear reports showing how our code is doing in details and also what needs fixing. Cons As admin of SonarQube, setting up project and configure/integrating this to other app like TeamCity or AWS codebuild was bit tricky. I was struggling to set it up at the beginning and also UI is not really intuitive. Also we have to manage its server as well like upgrading! Review Source Verified Reviewer Devops Manager Used the software for: Less than 1 year ### "A simple and easy way to integrate sonarcube code analysis solution" December 6, 2022 4.0 very good and super useful Pros easiness and robustness of integration with cloud. Cons a bit costly in sonarcloud but when you compare management cost ,its okey Review Source R Reviewer Software Developer Used the software for: 1-3 years ### "A free tool for source code analysis" April 13, 2023 5.0 It helped me to be able to do my job in improving the code, giving me possible solutions and saving me time. Pros What I find most useful in this software is the code analysis, which gives detailed reports of the errors found and then suggests possible solutions. This saves time in software development.In addition, their large community helps solve problems that arise along the way. Cons Sometimes the reports can give false positives, which requires that the personnel in charge of handling the software carefully review the results to avoid false positives. Review Source Moises F. Lead DevOps Engineer Used the software for: 3-5 years ### "Developer friendly SAST" December 8, 2022 4.0 Pros We really like the IDE tool called SonarLint which makes it easy for developers to integrate with most IDEs and lint their code even before committing it to the repos. Another advantage was that we were able to self host our own instance on our Kubernetes cluster and keep the versions based on the containers we specify to pull. Cons Other engines tend to scan the same code base faster. Not too much of a con since this is all automated. Review Source R Reviewer Quality Assurance Engineer Used the software for: Less than 1 year ### "Loved using SonarQube!!!" May 2, 2022 5.0 We primarily need to perform some static analyses. Everyone sends a pool request while they're coding. We must guarantee that the code is up to date before committing it to the main branch. That's basically how we work to make sure that whatever rules we've set up, whatever gates we've set up, are followed before we commit the code to the main branch. I had a lot of fun with the powerful tool. Pros The way it evaluates all of the code generated and reports on any violations of standard coding help us optimize the written code, ensuring that the smallest number of lines are created to properly cover the functionality. It offers a lovely user interface with distinct groups of infractions ranging from small to large, and it involves fixing the code's needless complexity. It also aids in the removal of duplicate code that has been used several times and the upkeep of method standards. Cons Integrating Sonarqube into CI/CD Pipelines takes time, and it may take even longer if the developer is newer. More real-time solutions could be included in the available guide, making it easier to handle issues and complete the integration. Review Source R Reviewer Architecte organique Used the software for: 3-5 years ### "SonarQube l'outil a avoir" February 20, 2023 5.0 J'ai utilisé Sonarqube que ce soit avec l'invite de commande de faire une analyse du code avant de le pousser. et aussi la création du pipeline de compilation. Pros il s'intègre dans le pipeline de compilation Cons L'analyse du code prend du temps et parfois, il y a des recommandations qu'on ne peut pas corriger Review Source R Reviewer Software Engineer Used the software for: 1-3 years ### "Perfect for detecting unit test coverage" March 3, 2025 4.0 Pros SonarQube is good at enforcing minimum code coverage on PRs Cons It is really difficult to run it locally, however once set up on github it runs well, and provides valuable insights on code coverage. Review Source JS Jimmy S. Oficial de seguridad de la informacion Used the software for: 1-3 years ### "Mejoras para Sonarqube" January 26, 2025 4.0 Buena herramienta para equipo red de una empresa y de manera gratis puedes crear plantillas de correo para todas las areas o parte de ellas Pros Envió de campañas de phising a usuarios de la empresa para reforzar ciberseguridad de las empresas Cons la configuración inicial es complicada y la gestión de seguridad envió de correos, hay pocos ejemplos practicos o estan fuera de actualizacion Review Source R Reviewer Java Developer Used the software for: 3-5 years ### "Well defined by consistency and high operability" May 15, 2024 4.0 Brings quality and professionalism in the final results. It is an impressive tool. Pros One of the outstanding values about SonarQube is the speed of analysis. It makes it easy to collaborate with other features to generate clean codes. I and my team had an easy time during deployment. It was quite easy to relate with our needs. Combining all this benefits leads to a consistent and reliable coding behavior. Cons Installation of the tool was troublesome. We were forced to buy a new device with higher processing speed to avoid the numerous rebooting. Later, deployment and use was smooth. Review Source R Reviewer IT Strategy Used the software for: 3-5 years ### "SonarQube cornerstone of our continuous development lifecycle " May 6, 2024 5.0 Pros Easy to use interface Rules flexibility Broad set of rules to activate Cons No roadmap for dynamic analysis Reports API not so flexible Fixed price approach Review Source Similar Products Featured ## Send me user reviews about this product ### Fill out the form and we'll send a list of the top-rated software based on real user reviews directly to your inbox.