SonarQube

SonarQube, by Sonar, is a static analysis platform that continuously inspects source code to catch bugs, security vulnerabilities, and maintainability issues ("code smells") before they reach production. It analyzes code across 30+ programming languages, applies thousands of rules, and reports issues with clear explanations and remediation guidance, helping teams enforce consistent quality and security standards. Its "Clean Code" philosophy and Quality Gate — a pass/fail check on new code — make code health an objective, enforceable part of the development workflow. SonarQube fits into the developer pipeline. It integrates with CI/CD (Jenkins, GitHub Actions, GitLab, Azure DevOps) to analyze every build, decorates pull requests with findings so issues are caught at review, and its "clean as you code" approach focuses on keeping new code clean rather than boiling the ocean on legacy debt. It covers security (SAST) including OWASP/CWE issues and secrets detection, and offers branch analysis, portfolio views for leadership, and IDE feedback via SonarQube for IDE (SonarLint). SonarQube Cloud (formerly SonarCloud) provides a hosted option alongside self-hosted editions. SonarQube serves development and security teams that want to bake quality and security into their workflow. The self-hosted Community Build is free and open source (main-branch analysis); Developer Edition starts around $2,500/year (up to ~100K lines of code), Enterprise Edition around $16,000/year (~1M LOC), and Data Center Edition around $100,000/year, all priced by lines of code. SonarQube Cloud is free up to ~50K LOC, with a Team plan around €30/month and custom Enterprise. It competes with Snyk, Veracode, Checkmarx, and GitHub Advanced Security, differentiating on code quality plus security and its clean-code workflow.