SonarQube comes up in these comparisons a lot, which is a bit odd when you remember what it actually is. It is a code quality tool. A really good one. It just wandered into the security aisle at some point and never left.
Where Sonar is good
Credit first. If you want to track code smells, complexity, duplication, maintainability, and test coverage trends over time, Sonar is excellent and has been for years. Teams that care about keeping a big codebase clean get real value out of it. That is its home turf and it is genuinely strong there.
Where the security framing falls apart
The problem is the security framing. SonarQube's vuln detection is bolted onto a quality engine, and it shows. It is pattern and rule based like the rest, so it inherits the same ceiling, but it is also tuned for "is this code tidy" rather than "can someone exploit this."
So you get a pile of maintainability findings dressed up next to a handful of shallow security ones, and the actual exploitable stuff sails straight through:
- Logic flaws
- Auth that breaks across multiple files
- Injection that only shows up second order It was never built to find those. Nobody should be surprised it does not.
We do not have to argue it
RealVuln is our open benchmark: 676 real vulnerabilities across 26 production repositories, plus 120 false positive traps built in to catch tools that flag everything to inflate recall.
RealVuln
- 676 real vulnerabilities
- 26 production repos
- 120 false positive traps
- Sonar score: ~6 to 7%
- fully open source
Sonar lands at the bottom, around 6 to 7 percent. That is not us cherry picking. The whole thing is open source and you can run Sonar against it yourself. We published it so the numbers do the talking instead of the marketing.
So which one
This is not "Sonar bad." Sonar is a good tool aimed at a different job. Keep it for code quality if that is what your team uses it for. Just do not let "we run SonarQube" be the thing you tell your customers when they ask if your code is secure, because those are two different questions and Sonar only answers one of them.
Full breakdown and the benchmark: https://kolega.dev/compare/sonarqube/
Top comments (0)