SonarQube, by Sonar (SonarSource), is a code-quality and SAST platform with integrated secrets detection and infrastructure-as-code (IaC) analysis. The free Community Build is self-hostable (LGPLv3 core, with bundled analyzers under the Sonar Source-Available License since Nov 2024), while paid Developer, Enterprise, and Data Center editions add deeper SAST and scale, priced per instance per year by lines of code. SonarQube Cloud offers a free tier for small private projects and free analysis of open-source projects.
sastcode-qualitysonarqubeopen-source
Overview
- Founded
- 2008
- Pricing tier
- Mid
- Startup-friendly
- Yes
- Enterprise-ready
- Yes
App & code security (SAST/SCA)
- SAST
- Yes
- SCA
- No
- Secret scanning
- Yes
- DAST
- No
- Container scanning
- No
- IaC scanning
- Yes
- CI/CD integration
- Yes
- Open-source
- Yes
- Self-hostable
- Yes
- Free tier
- Yes: Community Build free & self-hostable (LGPLv3 core; analyzers SSALv1 since Nov 2024); SonarQube Cloud free for private projects up to 50k LoC and free for OSS