SonarQube Erfahrungen

4,6
Gesamtbewertung
Bewertungen

4,6
Gesamtbewertung
Bewertungen
Mehr Erfahren

Nutzerbewertungen im Überblick

Über SonarQube

SonarQube ist ein führendes Tool zur kontinuierlichen Überprüfung der Codequalität und -sicherheit deiner Codedatenbanken. Die Software unterstützt deine Entwicklungsteams während der Codebewertung. SonarQube umfasst 27 Programmie...

Mehr erfahren

Funktionsbewertungen

Preis-Leistungs-Verhältnis
4,5
Funktionen
4,4
Bedienkomfort
4,3
Kundenbetreuung
4,1

Nutzerbewertungen zu SonarQube durchsuchen

60 von 60 Bewertungen
Sortieren nach:
Sachin
Sachin
  • Branche: Computer-Software
  • Unternehmensgröße: 10.000+ Mitarbeiter
  • Täglich für 6-12 Monate genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
5
Bedienkomfort
5
Kundenbetreuung
4

5
Bewertet am 23.5.2022

Code Analysis and ensuing security against threats

Overall experience with Sonarqube is pretty wholesome integration came handy with my CI/CD tools such as Azure Devops and Jenkins. Provides insights against vulnerabilities and common threats so that necessary actions can be taken by developers to ensure the security and good coding practices to follow. Features like PR decoration allows to get results in CI/CD tools itself if passed then only commit happens to master branch.

Vorteile

Feature like Code Analysis and publishing those analysis report to end user. You can use default Quality Gates and Quality Profiles for scanning of your code. In case you want to modify these you can do that and define your own rule. Whenever there's commit in repo you just need to configure the task in your continuous integration pipeline if it passed the parameter only then commit will happens the master/main branch otherwise it will not. With these features you can eliminate the security threats and ensure that developers are following good practices while developing their code. I have integrated it with Azure DevOps.

Nachteile

Only thing which I can think can be improved is logging of events. Sometime it becomes hard to debug the issues. Other then that, I think over all this fulfills all the requirements.

Verifizierter Rezensent
  • Branche: Informationstechnologie & -dienste
  • Unternehmensgröße: 501–1.000 Mitarbeiter
  • Täglich für Mehr als 1 Jahr genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
5
Bedienkomfort
5
Kundenbetreuung
4

5
Bewertet am 25.8.2022

Best Code Quality check Tool

We are really taking help of SonarQUbe in maintaining code quality. Doing code scanning on each JIRA story completion. It also helps our developers to improve their code quality. Coding standards are better now. Reports are very useful.

Vorteile

1. Calculate the quality of code and also helps to improve the quality by providing the solution
2. Highlight the vulnerabilities , repetitive line of code
3. Developer Friendly tool as it provides recommendations on the line of code which needs an improvement.
4. Create Scan reports on demand
5. Option to add exception in code

Nachteile

1. Report Generation sometime take long time.
2. User Interface should be enhanced.
3. Lack custom rule set
4. As per cost, it is little bit expensive.

In Betracht gezogene Alternativen

CodeScan

Warum SonarQube gewählt wurde

SOnarQube is better in terms of quality percentage, provide more insights.
Verifizierter Rezensent
  • Branche: Informationstechnologie & -dienste
  • Unternehmensgröße: 201–500 Mitarbeiter
  • Täglich für 6-12 Monate genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
Nicht verfügbar
Funktionen
3
Bedienkomfort
3
Kundenbetreuung
Nicht verfügbar

4
Bewertet am 30.3.2024

Elevate your code quality to the next level

The development process has been a bit slower than usual after SonarQube integration, but the quality and readability of the code is much better.

Vorteile

The main feature of SonarQube is that it detects code complexities within the code so that the developer can optimize it. It also detects accessibility and security issues; code smells and suggests changes.

Nachteile

It is a bit difficult to integrate with existing services and the quality checks may also conflict with other integrations.

Die besten Alternativen zu SonarQube

Chandramouli
  • Branche: Krankenhausversorgung & Gesundheitswesen
  • Unternehmensgröße: 501–1.000 Mitarbeiter
  • Täglich für 6-12 Monate genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
3
Funktionen
3
Bedienkomfort
3
Kundenbetreuung
2

3
Bewertet am 12.8.2021

Great tool to drive Coding Quality standards

PR analysis and Integration with Bitbucket are most in avoiding the new issues.
The tool needs a lot of improvements
1. Number of rules should be increased.
2. Few rules should have custom exclusions. Ex: Naming conventions => Organisation-specific words will be there which should be in Capital.
3. Generating a lot of false positives
4. Executive reports should generate based on scheduled triggers. We have 20 projects which are assigned to a Portfolio. if you are going to generate a report and send an email for the first portfolio calculation then the rest of the 19 projects info for that day will be missed. Higher management will think that the generated report is the latest but it is not.
5. PR analysis reports should be generated Quickly

Vorteile

PR analysis and Integration with Bitbucket are most helpful.

Nachteile

1. Number of rules should be increased.
2. Few rules should have custom exclusions. Ex: Naming conventions => Organisation-specific words will be there which should be in Capital.
3. Generating a lot of false positives
4. Executive reports should generate based on scheduled triggers. We have 20 projects which are assigned to a Portfolio. if you are going to generate a report and send an email for the first portfolio calculation then the rest of the 19 projects info for that day will be missed. Higher management will think that the generated report is the latest but it is not.
5. PR analysis reports should be generated Quickly

Antwort von SonarSource

Thank you for your review, Chandramouli. We appreciate your feedback, and invite you to join the SonarSource Community Forum.

SonarSource Community Forum: https://community.sonarsource.com/

Posting to the Forum will allow there to be transparency to the community, and allow our product managers & users to understand any issues you are facing.

To better assist you, please indicate what language(s), and how long the PR analysis is actually taking; as well as, examples of the false positives.

Thanks!

Beantwortet am 13.8.2021
Verifizierter Rezensent
  • Branche: Bankwesen
  • Unternehmensgröße: 10.000+ Mitarbeiter
  • Wöchentlich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
Nicht verfügbar
Funktionen
5
Bedienkomfort
4
Kundenbetreuung
Nicht verfügbar

4
Bewertet am 21.3.2024

Code Quality Assurance

Overall, impressed by this tool that supports multiple languages, monitoring code quality, bugs and vulnerability detection. Also, integrates well with Jenkins, GitHub, etc.

Vorteile

- It supports almost all commonly used languages like JAVA, Python, Javascript, etc.
- Integrates well with CI/CD pipeline established in tools like Jenkins and GitHub.
- Detects code duplication, bugs and vulnerabilities in code.

Nachteile

- May be complex to understand the reports for new users.
- May block delivery/deployment if hard gates are enabled by DevOps team which may delay project delivery.

Verifizierter Rezensent
  • Branche: Hochschulbildung
  • Unternehmensgröße: 1.001–5.000 Mitarbeiter
  • Monatlich für 6-12 Monate genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
4
Bedienkomfort
4
Kundenbetreuung
5

5
Bewertet am 23.12.2022

SonarQube is Great for Developers!

We could identify many code related issues that are presented in our code and improve the quality of the application that we are developing. As a overall, SonarQube tool is able to add a value to our applications.

Vorteile

It is simple for developers to recognize their code smells, unused lines of code, errors, problems with the third-party libraries they are using, etc. information and the precise location of the issue. It also offers answers to those problems. As a result, figuring out the problems and fixing them is simple. This will be a terrific tool for developers. Except that, we can introduce our own rules for checking the code quality. It could identify the code issues that are vulnerable to cyber attacks such as XSS, SQL Injection, etc.

Nachteile

It was difficult to use the SonarQube on-premise application. Once we pushed a new code section, the server needed to restart in order for the application to work.

Mo
Mo
  • Branche: Rechtsberatung
  • Unternehmensgröße: 501–1.000 Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
5
Bedienkomfort
5
Kundenbetreuung
4

4
Bewertet am 7.12.2022

Developer friendly SAST

Vorteile

We really like the IDE tool called SonarLint which makes it easy for developers to integrate with most IDEs and lint their code even before committing it to the repos. Another advantage was that we were able to self host our own instance on our Kubernetes cluster and keep the versions based on the containers we specify to pull.

Nachteile

Other engines tend to scan the same code base faster. Not too much of a con since this is all automated.

Susan
  • Branche: Fluggesellschaften/Luftfahrt
  • Unternehmensgröße: 201–500 Mitarbeiter
  • Täglich für 6-12 Monate genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
4
Funktionen
4
Bedienkomfort
5
Kundenbetreuung
5

5
Bewertet am 11.7.2023

Great product!

Vorteile

This product has actually improved productivity within my team by making sure there’s no duplicate code and by making code easily understandable.

Nachteile

Code maintenance is actually a difficult part.

Anselmo
  • Branche: Finanzdienstleistungen
  • Unternehmensgröße: 501–1.000 Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
5
Bedienkomfort
4
Kundenbetreuung
4

5
Bewertet am 3.5.2024

SonarQube cornerstone of our continuous development lifecycle

Vorteile

Easy to use interface
Rules flexibility
Broad set of rules to activate

Nachteile

No roadmap for dynamic analysis
Reports API not so flexible
Fixed price approach

Verifizierter Rezensent
  • Branche: Informationstechnologie & -dienste
  • Unternehmensgröße: 1.001–5.000 Mitarbeiter
  • Täglich für 1-5 Monate genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
Nicht verfügbar
Funktionen
5
Bedienkomfort
5
Kundenbetreuung
Nicht verfügbar

5
Bewertet am 28.4.2024

SonarQube reivew

Vorteile

SonarQube provides important metrics such as code smells, bugs, vulnerabilities, and code coverage. Easy integration with CI/CD tools.

Nachteile

SonarQube may produce false positives, as with any static analysis tool.

Verifizierter Rezensent
  • Branche: Informationstechnologie & -dienste
  • Unternehmensgröße: Selbstständig
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
4
Bedienkomfort
5
Kundenbetreuung
Nicht verfügbar

5
Bewertet am 24.12.2022

Measure the quality of your software

Vorteile

I like sonarqube dashboard and the flexibility that quality gates provide to measure your software quality. You can set up you own thresholds for maintenance, reliability, security, code coverage and many other metrics, and allow only versions passing this quality gate to be deployed.

Nachteile

Unfortunately it lacks an easy way to see trends and go deep into which developers are the best/the worst. Also, it is paid if you need to analyse software in some languages, available only on the cloud.

In Betracht gezogene Alternativen

Kiuwan und Jenkins
Yusmeidy
  • Branche: Telekommunikation
  • Unternehmensgröße: 1.001–5.000 Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
4
Bedienkomfort
5
Kundenbetreuung
5

4
Bewertet am 14.5.2024

Well defined by consistency and high operability

Brings quality and professionalism in the final results. It is an impressive tool.

Vorteile

One of the outstanding values about SonarQube is the speed of analysis. It makes it easy to collaborate with other features to generate clean codes. I and my team had an easy time during deployment. It was quite easy to relate with our needs. Combining all this benefits leads to a consistent and reliable coding behavior.

Nachteile

Installation of the tool was troublesome. We were forced to buy a new device with higher processing speed to avoid the numerous rebooting. Later, deployment and use was smooth.

Kreasan
  • Branche: Bau
  • Unternehmensgröße: 10.000+ Mitarbeiter
  • Wöchentlich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
5
Bedienkomfort
5
Kundenbetreuung
4

5
Bewertet am 22.5.2024

SonarQube delivers high code quality standards for every project

Vibrant customer service and interactive product demo. Their work is great and commendable.

Vorteile

For a while, I used the SonarQube product demo which is great and interactive giving the best experience. The dashboard is easy to use since it is designed with a lot of clarity and motivation. While in use, SonarQube can detect and help remove secrets in code but at the same time offering security against any breaches. Dealing with security vulnerabilities in codes is now made possible. Lastly, there are clear security reports in PDF form which helps us to evaluate the risks on our systems.

Nachteile

It meets our quality and security expectations. No setbacks.

Sadri
  • Branche: Computer-Software
  • Unternehmensgröße: 201–500 Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
5
Bedienkomfort
5
Kundenbetreuung
4

5
Bewertet am 18.2.2023

SonarQube l'outil a avoir

J'ai utilisé Sonarqube que ce soit avec l'invite de commande de faire une analyse du code avant de le pousser. et aussi la création du pipeline de compilation.

Vorteile

il s'intègre dans le pipeline de compilation

Nachteile

L'analyse du code prend du temps et parfois, il y a des recommandations qu'on ne peut pas corriger

Carlos
  • Branche: Bankwesen
  • Unternehmensgröße: 51–200 Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
Nicht verfügbar
Funktionen
3
Bedienkomfort
4
Kundenbetreuung
Nicht verfügbar

4
Bewertet am 12.3.2023

Sonarqube essential code quality analysis tool

In short, it is an indispensable tool and should be mandatory in all software development companies.

Vorteile

The ability to analyze the quality of the code in each deployment or integration, together with the possibility of modifying the rules to allow deployment or not (quantity or criticality of errors or defects), as well as vulnerability analysis allows for better software, always keeping in mind of the developers the quality and security of the code.

Nachteile

Like everything, the time it takes to leave it well configured and integrated with the rest of the systems, as well as the maintenance and updating of the standards, rules and vulnerabilities depending on the programming language and the news that are published at the level of security.

Verifizierter Rezensent
  • Branche: Informationstechnologie & -dienste
  • Unternehmensgröße: 1.001–5.000 Mitarbeiter
  • Wöchentlich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
5
Bedienkomfort
4
Kundenbetreuung
Nicht verfügbar

5
Bewertet am 30.11.2022

The least you can do for software quality

Vorteile

Sonarqube allows anyone to run a scan for code smells, bugs or vulnerabilities. There is no reason not to use it or integrate it into your CI/CD pipelines. Even if you do not enforce passing the quality gate, it helps a lot in tracking and highlighting where are your weaknesses. Code duplication and Code coverage are very useful tools to understand the overall quality of your development.

Nachteile

It is hard to view historic data, and once you run a new analysis you cannot see the previous ones anymore from the same unified dashboard, you have to enter into each metric and check the history link. Please bring back the history dashboard from sonar 5!

In Betracht gezogene Alternativen

Kiuwan
Verifizierter Rezensent
  • Branche: Computer-Software
  • Unternehmensgröße: 10.000+ Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
Nicht verfügbar
Funktionen
5
Bedienkomfort
4
Kundenbetreuung
Nicht verfügbar

3
Bewertet am 15.1.2023

Excellent code assurance tool

It's a great tool and be understood by experienced people more easily.

Vorteile

Sonarqube helps me find out if there are any repetitive lines in my code. Since the code sometimes get lengthy or at times missed by me to recheck. It is added in continuous integration in jenkins which when runs code smells, coverage and quality will be detected.

Nachteile

At times we need to precisely set all the settings for the issues to be detected. If any small mistake happens then no result can be seen. We use traditional sonarqube where we install and integrate rather then plugin in jenkins. So the traditional method needs to be more careful in installing and running it.

Daniel
  • Branche: Immobilien
  • Unternehmensgröße: 201–500 Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
3
Funktionen
3
Bedienkomfort
3
Kundenbetreuung
3

4
Bewertet am 16.8.2021

Review

It have been a mixed ride overall. The actualy code analysis is really great, the rest is so so.

Vorteile

The amount of errors it catches and that developers code look somewhat similar in mindset after using it for some time.

Nachteile

The setup with CodeCoverage is a nightmare and it seems is not working equallty well all the time. We also have a solution where it doesn't even work.

Antwort von SonarSource

Hi Daniel. Thank you for your review of SonarQube. We appreciate your feedback! Regarding your code coverage issues, have you checked out our Community Forum? There may be a solution/fix already identified and if not, you can easily start a new thread and provide us with the details around your workflow, language(s), etc. Thanks!

Community Forum: https://community.sonarsource.com/

Beantwortet am 19.8.2021
Flor
Flor
  • Branche: Computer-Software
  • Unternehmensgröße: 11–50 Mitarbeiter
  • Täglich für Mehr als 1 Jahr genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
4
Bedienkomfort
3
Kundenbetreuung
4

5
Bewertet am 10.4.2023

A free tool for source code analysis

It helped me to be able to do my job in improving the code, giving me possible solutions and saving me time.

Vorteile

What I find most useful in this software is the code analysis, which gives detailed reports of the errors found and then suggests possible solutions. This saves time in software development.In addition, their large community helps solve problems that arise along the way.

Nachteile

Sometimes the reports can give false positives, which requires that the personnel in charge of handling the software carefully review the results to avoid false positives.

Marcin
  • Branche: Informationstechnologie & -dienste
  • Unternehmensgröße: 10.000+ Mitarbeiter
  • Täglich für 6-12 Monate genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
2
Funktionen
3
Bedienkomfort
3
Kundenbetreuung
2

4
Bewertet am 11.12.2022

Staple in the CI/CD pipelined quality gate solutions

It allows our dev teams to keep consistent level of code quality and known issues proof in code and used target platforms so as to provide to end users/customers highest quality products delivered in CI/CD methodology.

Vorteile

Easily add source code analysis for potential bugs and pitfalls to warrant against developers' errors or just not efficient coding by novices, projects dependencies on vulnerable platforms and potential long-term support issues due to how your code is structured. Simple deployment of binaries needed for scans for major target build environments OSes, plus easy to use APIs, all for the benefit of easy integration into CI/CD pipelines.

Nachteile

Caps and limits on key server instance component required when obtaining config for project and preset rules, when sending analysis results or getting quality gate results may make the pipelines seem to fail without easier discerning real reasons.

Gaurav
  • Branche: Automotive
  • Unternehmensgröße: 10.000+ Mitarbeiter
  • Täglich für 6-12 Monate genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
5
Bedienkomfort
5
Kundenbetreuung
4

4
Bewertet am 17.7.2022

Sonarqube a static code analysis for quality and security of the code

We have been using sonarqube in our cicd pipeline for static code analysis and its been very helpful identifying the bugs early in the stages. This tool is best in the market but still missing on some functionalities, mainly in dashboards.

Vorteile

1. Ensures that only quality, bugfree and vulnerabilities free code goes into production and improves developer’s skills.
2. Supports 24+ languages.
3. Open source version.
4. Developer workflow integration
5. Detect the bugs early in development and send alerts to developers to have a look into suspicious code snippets.
6. The results are faster and can get integrated within pipeline.

Nachteile

1. Integration with the third party apps could be improved.
2. Dashboards could be better and code security features can be added more.
3. Sometimes false positive results

kiruthiga
  • Branche: Informationstechnologie & -dienste
  • Unternehmensgröße: 5.001–10.000 Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
4
Funktionen
5
Bedienkomfort
5
Kundenbetreuung
2

4
Bewertet am 8.4.2021

SonarQube Usage review

Cheap and good for Code Vulnerability scans.

Vorteile

The vulnerability scans that it uses encompasses a lot of languages. It also has ability where user can define custom profiles and rules. Dashboards created are easy to use and decipher.

Nachteile

Technical support is very expensive and need to use their community forums to get support.

Antwort von SonarSource

Thank you for your review, kiruthiga!

Beantwortet am 14.10.2021
Verifizierter Rezensent
  • Branche: Informationstechnologie & -dienste
  • Unternehmensgröße: 10.000+ Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
4
Bedienkomfort
4
Kundenbetreuung
5

5
Bewertet am 11.7.2021

Great tool to drive Coding Quality standards

Driving code quality standards across enterprise and inducing code quality gates in the continuous integration workflow

Vorteile

Static code analysis, support for Java, .Net, JavaScript, typescript, html, CSS, etc. Helps you set custom quality gates and rules as well

Nachteile

Community version does not support high availability. You need to pay for this feature, would have preferred it to be free. Tools upgrade process can be improved as we have to take down the tool instance.

Antwort von SonarSource

Thank you for your review!

Beantwortet am 14.10.2021
Thenappan
  • Branche: Informationstechnologie & -dienste
  • Unternehmensgröße: 51–200 Mitarbeiter
  • Täglich für Mehr als 2 Jahre genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
Nicht verfügbar
Funktionen
4
Bedienkomfort
4
Kundenbetreuung
3

5
Bewertet am 24.1.2022

Keeps ur code intact with less grammar mistake

Vorteile

it allows us to correct the grammatically wrong code , unused imports ,variables etc. It Helps us to optimize the code with the rules specified for that project. Allows us to remove the duplicate code as well.

Nachteile

Integration with visual studio code and binding with project is tad difficult . Duplicate code block appears only after the build , so we have to wait till the build is completed to view whether any duplicate is present in our code.

Vishvesh
Vishvesh
  • Branche: Computer-Software
  • Unternehmensgröße: 201–500 Mitarbeiter
  • Wöchentlich für 6-12 Monate genutzt
  • Quelle der Bewertung
Preis-Leistungs-Verhältnis
5
Funktionen
5
Bedienkomfort
5
Kundenbetreuung
5

5
Bewertet am 27.4.2022

Loved using SonarQube!!!

We primarily need to perform some static analyses. Everyone sends a pool request while they're coding. We must guarantee that the code is up to date before committing it to the main branch. That's basically how we work to make sure that whatever rules we've set up, whatever gates we've set up, are followed before we commit the code to the main branch. I had a lot of fun with the powerful tool.

Vorteile

The way it evaluates all of the code generated and reports on any violations of standard coding help us optimize the written code, ensuring that the smallest number of lines are created to properly cover the functionality. It offers a lovely user interface with distinct groups of infractions ranging from small to large, and it involves fixing the code's needless complexity. It also aids in the removal of duplicate code that has been used several times and the upkeep of method standards.

Nachteile

Integrating Sonarqube into CI/CD Pipelines takes time, and it may take even longer if the developer is newer. More real-time solutions could be included in the available guide, making it easier to handle issues and complete the integration.

60 Bewertungen