SonarQube
SonarQube is the algorithmic verification platform for code quality and security. Its static analysis applies techniques such as symbolic execution and data and control flow analysis to inspect your code, find bugs, vulnerabilities, and structural problems, and tell you exactly what to fix and why, in your IDE, your pull requests, and your CI pipeline.
This repository holds the source of the SonarQube Community Build, the free, open-source edition of the SonarQube platform. It shares the same analysis used across the SonarQube product line.
Built for the AI era
AI writes code faster than teams can review it, creating verification debt: code reaching production before anyone has confirmed what it does. SonarQube applies the same consistent, explainable analysis to every line, whether a developer or an agent wrote it. Vibe, then verify: generate fast, then verify what reaches production. It is the verification stage of the Agent Centric Development Cycle, running in the outer CI verification loop to verify code before it merges.
What SonarQube finds
- Bugs and reliability issues that break behavior at runtime.
- Security vulnerabilities and security hotspots, with clear guidance on the risk and the fix.
- Maintainability and structural issues that make code harder to change over time.
- Coverage on new code, so quality improves with every commit instead of stalling behind a backlog.
The SonarQube platform analyzes more than 40 programming languages and frameworks; the Community Build supports a subset of them. Analysis is repeatable, auditable, and explainable: the same code always produces the same findings, every finding is traceable, and each one tells you what the problem is and why it matters.
Commercial editions
SonarQube Server and SonarQube Cloud include everything in the Community Build and add:
Detect more
- More bugs, vulnerabilities, code quality issues, and architecture issues, through broader coverage and deeper analysis.
- More languages and frameworks than the Community Build.
- Software composition analysis (SCA) for vulnerable and risky open-source dependencies.
- Advanced security with deep taint analysis (SAST) that traces vulnerabilities across data flows.
- Secrets detection for leaked credentials, tokens, and keys.
- Infrastructure as code (IaC) analysis for Terraform, Kubernetes, Docker, and CloudFormation.
- Architecture management to define architectural constraints and catch structural violations.
Analyze your whole workflow
- Branch analysis and pull request decoration, so every change is verified before it merges.
Govern, report, and see across teams
- Portfolios and applications that roll up quality and security across many projects.
- Executive dashboards and trend reporting.
- Security and compliance reports, including OWASP Top 10, CWE, and PCI DSS.
- Enterprise governance: enforce Quality Gates and permissions across teams, with full audit trails.
Fix
- SonarQube Remediation Agent to reduce technical debt by fixing SonarQube issues for you, opening verified fix pull requests you can review and merge.
Some capabilities are part of the SonarQube Advanced Security add-on. See the product line for details.
Quality gates
A Quality Gate is a pass-or-fail check on your new code. Set the standard once, and SonarQube enforces it automatically in every pull request and pipeline, so issues are caught before they merge rather than found in production.
The SonarQube product line
The Community Build is free and open source. The wider SonarQube line applies the same analysis across your workflow:
Compare SonarQube plans and pricing to choose the appropriate product and deployment model.
Product links
FAQ
Is the Community Build free? Yes. It is free and open source, and this repository is its source.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
