SonarQube
Open-source platform for continuous inspection of code quality
From Wikipedia, the free encyclopedia
SonarQube is an open-core static code analysis platform developed by Sonar.[2] It scans source code to detect issues like bugs, vulnerabilities and code smells on various programming languages and infrastructure technologies.[3] SonarQube offers reports on duplicated code, coding standards, unit tests, code coverage, technical debt, code complexity, comments, bugs, software bill of materials (SBOMs), and security recommendations.[4]
| SonarQube | |
|---|---|
| |
 A SonarQube project homepage | |
| Developer | Sonar |
| Release | 2006–2007[1] |
| Stable release | SonarQube Server Release 2025.1
/ Jan 2025 |
| Written in | Java |
| Operating system | Cross-platform |
| Type | Static code analysis |
| License | Partly Proprietary and partly GNU Lesser General Public License |
| Website | Official website |
| Repository | |
Overview
SonarQube analyzes code to detect problems related to software security, reliability, and maintainability.[2] It integrates with DevOps platforms, including GitHub, Bitbucket, Azure, and GitLab.[5] The commercial offerings of SonarQube supports programming languages such as Java (including Android), C#, C, C++, JavaScript, TypeScript, Python, Go, Swift, COBOL, Apex, PHP, Kotlin, Ruby, Scala, HTML, CSS, ABAP, Flex, Objective-C, PL/I, PL/SQL, RPG, T-SQL, VB.NET, VB6, and XML.[6]
Products
The umbrella term SonarQube encompasses multiple products:
- SonarQube Server (formerly known as just SonarQube) is the self-hosted variant of the tool.
- SonarQube Community Build is a free and open-source build of SonarQube Server that lacks the proprietary features.
- SonarQube Cloud (formerly SonarCloud) is a fully managed SaaS solution.
- SonarQube for IDE (formerly SonarLint) is a summary term for the various IDE plug-ins for Eclipse, Visual Studio, Visual Studio Code, Cursor, Windsurf, and IntelliJ IDEA.[7]
- SonarQube Advanced Security is a licensable feature that extends the code security capabilities to support scanning third-party open source code.[8]
Features
Advanced Static Application Security Testing (SAST)
Advanced SAST, included in SonarQube Advanced Security, scans for vulnerabilities that stem from the analyzed code interacting with third-party open-source dependencies[9] for Java, C#, and JavaScript/TypeScript code.[10][11]
Software Composition Analysis (SCA)
SCA, included in SonarQube Advanced Security, lists known vulnerabilities (CVEs) in third-party dependencies, generates software bill of materials (SBOMs) and enforces open source license policies.[9][12]
AI Code Assurance
AI Code Assurance detects code created in GitHub projects by GitHub Copilot and applies a separate static analysis rule set to this code.[13][14]
AI CodeFix
AI CodeFix automatically generates suggestions to fix issues detected by static code analysis within the IDE plugins or in SonarQube Cloud and Server.[13]
Secrets Detection
Secrets Detection flags secrets in source code, both in code repositories and the supported IDEs, for example, passwords, application programming interface (API) keys, encryption keys, tokens, database credentials.[15][9]
