SonarQube

Vorteile

What I find most useful in this software is the code analysis, which gives detailed reports of the errors found and then suggests possible solutions. This saves time in software development.In addition, their large community helps solve problems that arise along the way.

Nachteile

Sometimes the reports can give false positives, which requires that the personnel in charge of handling the software carefully review the results to avoid false positives.

Vorteile

One of the outstanding values about SonarQube is the speed of analysis. It makes it easy to collaborate with other features to generate clean codes. I and my team had an easy time during deployment. It was quite easy to relate with our needs. Combining all this benefits leads to a consistent and reliable coding behavior.

Nachteile

Installation of the tool was troublesome. We were forced to buy a new device with higher processing speed to avoid the numerous rebooting. Later, deployment and use was smooth.

Vorteile

Sonarqube helps me find out if there are any repetitive lines in my code. Since the code sometimes get lengthy or at times missed by me to recheck. It is added in continuous integration in jenkins which when runs code smells, coverage and quality will be detected.

Nachteile

At times we need to precisely set all the settings for the issues to be detected. If any small mistake happens then no result can be seen. We use traditional sonarqube where we install and integrate rather then plugin in jenkins. So the traditional method needs to be more careful in installing and running it.

Vorteile

For a while, I used the SonarQube product demo which is great and interactive giving the best experience. The dashboard is easy to use since it is designed with a lot of clarity and motivation. While in use, SonarQube can detect and help remove secrets in code but at the same time offering security against any breaches. Dealing with security vulnerabilities in codes is now made possible. Lastly, there are clear security reports in PDF form which helps us to evaluate the risks on our systems.

Nachteile

It meets our quality and security expectations. No setbacks.

Vorteile

- It supports almost all commonly used languages like JAVA, Python, Javascript, etc.
- Integrates well with CI/CD pipeline established in tools like Jenkins and GitHub.
- Detects code duplication, bugs and vulnerabilities in code.

Nachteile

- May be complex to understand the reports for new users.
- May block delivery/deployment if hard gates are enabled by DevOps team which may delay project delivery.

Vorteile

The main feature of SonarQube is that it detects code complexities within the code so that the developer can optimize it. It also detects accessibility and security issues; code smells and suggests changes.

Nachteile

It is a bit difficult to integrate with existing services and the quality checks may also conflict with other integrations.

Vorteile

Easy to use interface
Rules flexibility
Broad set of rules to activate

Nachteile

No roadmap for dynamic analysis
Reports API not so flexible
Fixed price approach

Vorteile

I love SonarQube's real-time code analysis, providing instant feedback. Recently, while working on a project, it flagged potential code smells, helping me enhance code quality preemptively.

Nachteile

It is sometimes overwhelming amount of information and alerts, which can make it challenging to prioritize and address issues effectively.

Vorteile

SonarQube provides important metrics such as code smells, bugs, vulnerabilities, and code coverage. Easy integration with CI/CD tools.

Nachteile

SonarQube may produce false positives, as with any static analysis tool.

Vorteile

Report both security and code quality vulnerabilities, indicating the reason for the flaw and the possible resolution. It allows you to set thresholds so as not to compromise too much the quality of the code and the coverage of the tests.

Nachteile

It is necessary to configure it to avoid false positives in terms of code quality that can block the release of the code.

Vorteile

SonarQube est complet. Il permet l'analyse de nombreux langages de développement sur plusieurs projets. Il propose de base plusieurs jeux de règles de qualité à appliquer et permet d'en ajouter d'autre. Pour chaque règle un exemple est fourni et des explications assez claire. Certaines règles concernent la qualité du code, mais pas que. Certaines touchent à la sécurité et d'autres aux performances. L'intégration dans un process de build via des tâches ou des jobs est assez facile.

Nachteile

Le plus gros inconvénient de SonarQube est son coût qui peut s'avérer, selon les projets, un peu élevé. L'outil est néanmoins très facile à utiliser et à mettre en place.

Vorteile

Me gusta mucho la integración con el servicio de devops de azure, gracias a ello puedo integrar las tareas de revisión de código de SonartiQube en la integración continua. Los reportes que genera son de gran utilidad para detectar malas prácticas o brechas de seguridad en el código.

Nachteile

Me gustaría que el panel de administración de la herramienta fuera más configurable, para poder hacer que el análisis de código sea más efectivo.

Vorteile

Le fait que l'on puis enregistrer nos propre metriques pour les tests de qualités

Nachteile

La documentation n'est pas forcément la plus aisée

Vorteile

Easy-to-administer tool, with good functionality to monitor security part of your code (using SAST methodology), with ability to integrate with Jenkins, GitHub and other tools. You are able to fail the build if the code doesn't meet percentage score.

Nachteile

When new repository is added - there should be pop-up suggestion to create SonarQube project for it, coming from SonarQube. At the moment the user/administrator must watch out for new repositories in the organisation, without a note from the system itself that there is a new repository which you might want to add for scanning.

Vorteile

This product has actually improved productivity within my team by making sure there’s no duplicate code and by making code easily understandable.

Nachteile

Code maintenance is actually a difficult part.

Vorteile

Comprehensive code quality analysis. Really good to detect bugs, vulnerabilities and code smells. And integration with popular CI/CD pipelines is really impressive.

Nachteile

Setup and configuration can be complex for begineers. And limited support for some programming languages is what could be improved.

Vorteile

I love its ability to provide a clear and concise view of code quality.

Nachteile

At first, I found it a bit overwhelming to understand all the available features and settings. Although the documentation and support help, I think there could be a better guide for new users.

Vorteile

The ability to analyze the quality of the code in each deployment or integration, together with the possibility of modifying the rules to allow deployment or not (quantity or criticality of errors or defects), as well as vulnerability analysis allows for better software, always keeping in mind of the developers the quality and security of the code.

Nachteile

Like everything, the time it takes to leave it well configured and integrated with the rest of the systems, as well as the maintenance and updating of the standards, rules and vulnerabilities depending on the programming language and the news that are published at the level of security.

Vorteile

- integrate CI/CD- customizable Quality Profiles- easy to use

Nachteile

- performance Impact- limited programming language- open-source, some advanced features are only available in the commercial version

Vorteile

This is very good and user friendly application.

Nachteile

As such i didn't found any con for this application.

Vorteile

il s'intègre dans le pipeline de compilation

Nachteile

L'analyse du code prend du temps et parfois, il y a des recommandations qu'on ne peut pas corriger

Vorteile

SonarQube can integrate with CI/CD tools such as Jenkins, GitLab, and Travis CI, making it easy to automate code analysis as part of the development process. SonarQube allows developers to customize the rules and profiles used for code analysis.SonarQube provides a dashboard and reporting features that allow developers to track the progress of code quality metrics and identify areas that require attention. This feature can help developers stay on top of code quality issues and make data-driven decisions about where to focus their efforts.

Nachteile

Improving documentation could help users better understand how to use the tool effectively.

Vorteile

It is simple for developers to recognize their code smells, unused lines of code, errors, problems with the third-party libraries they are using, etc. information and the precise location of the issue. It also offers answers to those problems. As a result, figuring out the problems and fixing them is simple. This will be a terrific tool for developers. Except that, we can introduce our own rules for checking the code quality. It could identify the code issues that are vulnerable to cyber attacks such as XSS, SQL Injection, etc.

Nachteile

It was difficult to use the SonarQube on-premise application. Once we pushed a new code section, the server needed to restart in order for the application to work.

Vorteile

The tool that got us better code. The integration of libraries and the amount of languages is enough to work with and integrate with other DevOps applications which is easy. Everything is very intuitive including the initial setup. Setting up multiple rules for languages is included as well as security. The static code scanning feature is good. The only thing is that the UI integration could be improved.

Nachteile

The only thing is that the UI integration could be improved, maybe even better documentation, but otherwise I am satisfied with the application, deployment without problems, integration with other applications as well.

Vorteile

I appreciated how SonarQube offers an extensive collection of static code analysis tools that are user-friendly and comprehendible. They make it simple to quickly recognize potential errors and safety flaws in your code. Moreover, it has effective reporting features to allow you to keep track of and observe code quality over time.

Nachteile

The biggest downside of SonarQube is that it can be difficult to configure and set up. It also requires a lot of manual configuration and maintenance.

Vorteile

Its very helpful tool for improving code quality and find vulnerabilities in code which reduces the security issue as well as reduce issue on production. It check duplicate code, logical bug and many more.

Nachteile

Custom role adding is difficult rest all good.

Vorteile

I like sonarqube dashboard and the flexibility that quality gates provide to measure your software quality. You can set up you own thresholds for maintenance, reliability, security, code coverage and many other metrics, and allow only versions passing this quality gate to be deployed.

Nachteile

Unfortunately it lacks an easy way to see trends and go deep into which developers are the best/the worst. Also, it is paid if you need to analyse software in some languages, available only on the cloud.

In Betracht gezogene Alternativen

Vorteile

Easily add source code analysis for potential bugs and pitfalls to warrant against developers' errors or just not efficient coding by novices, projects dependencies on vulnerable platforms and potential long-term support issues due to how your code is structured. Simple deployment of binaries needed for scans for major target build environments OSes, plus easy to use APIs, all for the benefit of easy integration into CI/CD pipelines.

Nachteile

Caps and limits on key server instance component required when obtaining config for project and preset rules, when sending analysis results or getting quality gate results may make the pipelines seem to fail without easier discerning real reasons.

Vorteile

PR analysis and Integration with Bitbucket are most helpful.

Nachteile

1. Number of rules should be increased.
2. Few rules should have custom exclusions. Ex: Naming conventions => Organisation-specific words will be there which should be in Capital.
3. Generating a lot of false positives
4. Executive reports should generate based on scheduled triggers. We have 20 projects which are assigned to a Portfolio. if you are going to generate a report and send an email for the first portfolio calculation then the rest of the 19 projects info for that day will be missed. Higher management will think that the generated report is the latest but it is not.
5. PR analysis reports should be generated Quickly

Vorteile

1. Ensures that only quality, bugfree and vulnerabilities free code goes into production and improves developer’s skills.
2. Supports 24+ languages.
3. Open source version.
4. Developer workflow integration
5. Detect the bugs early in development and send alerts to developers to have a look into suspicious code snippets.
6. The results are faster and can get integrated within pipeline.

Nachteile

1. Integration with the third party apps could be improved.
2. Dashboards could be better and code security features can be added more.
3. Sometimes false positive results

Vorteile

1. Calculate the quality of code and also helps to improve the quality by providing the solution
2. Highlight the vulnerabilities , repetitive line of code
3. Developer Friendly tool as it provides recommendations on the line of code which needs an improvement.
4. Create Scan reports on demand
5. Option to add exception in code

Nachteile

1. Report Generation sometime take long time.
2. User Interface should be enhanced.
3. Lack custom rule set
4. As per cost, it is little bit expensive.

In Betracht gezogene Alternativen

Warum SonarQube gewählt wurde

Vorteile

All the vulnerabilities and possible exceptions are flagged which becomes easy for developer. Rules can be customized as per the requirement. Provides the examples of compliant and non-compliant code.

Nachteile

Sometimes there are false positive issues

Vorteile

Reports it generates and grades on vulnerabilities and highlights the scanned code

Nachteile

Integration with Visual Studio. Net code was not simple and easier.

Vorteile

Feature like Code Analysis and publishing those analysis report to end user. You can use default Quality Gates and Quality Profiles for scanning of your code. In case you want to modify these you can do that and define your own rule. Whenever there's commit in repo you just need to configure the task in your continuous integration pipeline if it passed the parameter only then commit will happens the master/main branch otherwise it will not. With these features you can eliminate the security threats and ensure that developers are following good practices while developing their code. I have integrated it with Azure DevOps.

Nachteile

Only thing which I can think can be improved is logging of events. Sometime it becomes hard to debug the issues. Other then that, I think over all this fulfills all the requirements.

Vorteile

We really like the IDE tool called SonarLint which makes it easy for developers to integrate with most IDEs and lint their code even before committing it to the repos. Another advantage was that we were able to self host our own instance on our Kubernetes cluster and keep the versions based on the containers we specify to pull.

Nachteile

Other engines tend to scan the same code base faster. Not too much of a con since this is all automated.

Vorteile

Sonarqube allows anyone to run a scan for code smells, bugs or vulnerabilities. There is no reason not to use it or integrate it into your CI/CD pipelines. Even if you do not enforce passing the quality gate, it helps a lot in tracking and highlighting where are your weaknesses. Code duplication and Code coverage are very useful tools to understand the overall quality of your development.

Nachteile

It is hard to view historic data, and once you run a new analysis you cannot see the previous ones anymore from the same unified dashboard, you have to enter into each metric and check the history link. Please bring back the history dashboard from sonar 5!

In Betracht gezogene Alternativen

Vorteile

The way it evaluates all of the code generated and reports on any violations of standard coding help us optimize the written code, ensuring that the smallest number of lines are created to properly cover the functionality. It offers a lovely user interface with distinct groups of infractions ranging from small to large, and it involves fixing the code's needless complexity. It also aids in the removal of duplicate code that has been used several times and the upkeep of method standards.

Nachteile

Integrating Sonarqube into CI/CD Pipelines takes time, and it may take even longer if the developer is newer. More real-time solutions could be included in the available guide, making it easier to handle issues and complete the integration.

Vorteile

Code review could be more focused on the new features implementation than trying to identify silly basic faults.

Nachteile

The Eclipse Sonarqube plugin was not easy to make it work in the same manner was it was setup in the CI/CD machines.

Vorteile

You can see the coverage in unit test, review the programming code with the best practice and the vulnerabilities in the code

Nachteile

The support is not included in the license.

Vorteile

Great knowledgebase in understanding the bugs and vulnerabilities and fixing them. Highly informational dashboard and tools to filter huge amount of repos.

Nachteile

Customizing rules are difficult. Certain times they will catch comments and rule engine still needs tweaking

Vorteile

Great tool to check the code quality like unit test cases, number of repetitive lines and other checks for coments and other. This helps us to set the rules which should be followed by the developer which maintains the consistency of the software for customers.

Nachteile

I don't have any much cons on this. But we need little good knowledge to handle this. It is little tricky to manage the application.

Vorteile

Static code analysis, support for Java, .Net, JavaScript, typescript, html, CSS, etc. Helps you set custom quality gates and rules as well

Nachteile

Community version does not support high availability. You need to pay for this feature, would have preferred it to be free. Tools upgrade process can be improved as we have to take down the tool instance.

Vorteile

The amount of errors it catches and that developers code look somewhat similar in mindset after using it for some time.

Nachteile

The setup with CodeCoverage is a nightmare and it seems is not working equallty well all the time. We also have a solution where it doesn't even work.

Vorteile

First of all, The tool has a great user interface highlighting all of the errors and bugs. It also shows how much effort is needed to fix those as well. We integrated it with our CI/CD pipelines in GitLab.

Nachteile

Enterprise licensing cost is a bit expensive. We faced rarely memory issues running the CI/CD pipelines.

Vorteile

1. Provides a detailed review of the code
2. It highlights suspicious code snippets
3. Strong integration with popular CI pipelines

Nachteile

1. Installation process should be smooth
2. Reporting is poor
3. Integration with IDE is not available

Vorteile

The ability to analyze static code is very useful to improve and maintain software quality. Defining special rules or editing the rules according to your needs provides flexibility.

Nachteile

in some scenarios, after updating the issue responsible, the same user may open an issue again in the next scan. we were forced to customize the rules for this.

Vorteile

Quality matters as much as Security. SonarQube supports both of those aspects very well. What is more it is done automatically with minimum configuration. Speed, reliability and flexibility makes SQ must have solution in every Organization.

Nachteile

Limited support for self-hosted repository was challenging. Another one is diversity of versions: ZIP, Docker and Cloud.

Vorteile

Multiple quality metrics for software develop and configurable quality gates

Nachteile

Some brakes with compatibility when doing migrations

Vorteile

Supporting developers to build high-quality apps

Nachteile

The very high Performance when comparing to CAST.

Vorteile

Best feature of SonarQube is that it can be integrated with most of the applications, and it provides static code Analysis for both frontend and backend code. I am using SonarQube for my APIs and Web code and for each build, I can see how many code smells i have inserted, how many are solved, What is the additional development time i have added. Now i can see the security status of the Web app as well like Cross Site issues etc. All these features are awesome

Nachteile

I cannot find any cons for this as of now