SonarQube review

SonarQube is code verification and governance for software teams, rather than a general-purpose security platform. SonarSource says its Server and Cloud options review code for quality, security, and compliance. Its stated approach is multi-layered, zero-trust verification, intended to make findings consistent, explainable, repeatable, and auditable. Teams can use quality gates to validate code before it is merged.

The product also covers work beyond code checks: SonarQube Advanced Security assesses dependencies and the software supply chain, while SonarQube Remediation Agent opens verified pull requests to address technical debt. These capabilities do not all come with the same base subscription. Advanced Security requires an additional subscription, and its price is not published. The practical fit is teams that want code checks in their development workflow and governed through repeatable rules. SonarQube is less clearly a replacement for every security scanner or manual review process.

The main appeal is a defined review process: SonarQube checks code across quality, security, and compliance, and quality gates can stop code before it is merged. SonarSource describes findings as explainable and auditable, which can help teams that need consistent checks rather than informal reviewer-by-reviewer standards.

There are low-cost ways to start. According to the pricing page, the Developers plan is free forever for private projects up to 50,000 lines of code (LOC), with no credit card or expiry. Eligible public, OSI-licensed repositories can use the free OSS plan, which includes SonarQube for OSS and Gitar AI Code Review for OSS. Team starts at $34 per month for teams under 50 developers and includes up to 100,000 private LOC at that starting price, plus 35+ languages. A 14-day trial is listed.

A commenter on r/devsecops notes that SonarQube can provide code-quality metrics and may complement a separate security tool. Enterprise lists 45+ languages, SSO and SCIM, portfolios, and OWASP/MISRA reporting.

The price depends on how much code you analyze and which capabilities you need. The free private-project plan stops at 50,000 LOC; Team starts at $34 monthly for up to 100,000 private LOC. The pricing page does not list an annual Team price. Advanced Security costs extra, but its subscription price is not published. Team commercial support also requires contacting sales for pricing.

Enterprise is aimed at organizations with over 50 developers, is priced annually by quote, and lists commercial support starting at 5 million LOC. That leaves a meaningful pricing gap for larger teams that want a firm cost before talking to sales. One Reddit thread describes SonarQube, Snyk, and manual reviews as disconnected, with overlapping findings and separate dashboards; that is one team’s account, not proof every setup has the same problem. Separately, users in an alternatives thread cite dissatisfaction with SonarSource support. Treat that as a warning to confirm support terms, not a universal verdict. Gitar AI Code Review Enterprise pricing is also unpublished and outcome-based per pull request.

SonarQube has a free tier, then Team starts at $34 per month, according to the pricing details checked on November 6, 2026. Team is for organizations with under 50 developers and includes up to 100,000 private lines of code (LOC) at the starting price. It is billed monthly; no annual Team price is listed. The free Developers plan covers up to 50,000 private LOC, so moving from free to Team doubles that stated cap, but the price for higher LOC use is not provided here.

Enterprise is for organizations with over 50 developers, billed annually, and quote-based; its price is not published. It lists 45+ languages, SSO and SCIM, portfolios, and OWASP/MISRA reporting. Advanced Security needs an additional subscription, although it is included in the Team trial. Team commercial support also costs extra, with pricing available through sales. Enterprise Gitar AI Code Review has unpublished, per-PR outcome-based pricing. A separate Gitar AI Code Review Core plan is $20 per user per month, billed annually. The free OSS offer is limited to public, OSI-licensed repositories.

SonarQube offers Server and Cloud, but the published product information does not explain how to migrate between them, export findings, or transfer configuration. Treat those as pre-sale questions, not details to assume. Before switching, inventory your languages, private LOC, quality gates, and security requirements; those affect whether the free tier or Team’s 100,000-LOC starting allowance fits. Check how your existing CI process will connect, too—the available published material does not specify migration steps.

Our verdict flags support satisfaction as a concern, and Team commercial support costs extra; Enterprise support is available starting at 5M LOC. We don’t have Reddit posts or comments in the published material to substantiate why users leave, or to verify complaints about exports or lock-in. Ask SonarSource for written answers on data portability, configuration migration, support response terms, and what happens to findings if you cancel. If those answers are important to your decision, get them before moving repositories or building workflows around the platform.