{"slug": "sonarqube", "name": "SonarQube", "category": "other", "category_name": "Other software", "description": "", "recommenders": 3, "commenters": 12, "warners": 2, "score": 2.726, "rising": -0.98, "first": "2025-11-29", "latest": "2026-10-17", "why": "it has found several real vulnerabilities for me before", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 8, "compare": 0, "warn": 3}, "spark": [0, 0, 0, 1, 2, 0, 0, 0, 0, 0, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "it has found several real vulnerabilities for me before", "kind": "", "icon": true, "domain": null, "github_repo": null, "official_url": "https://www.sonarsource.com/products/sonarqube/", "pricing": "", "aliases": ["SonarQube"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 759608304, "item_id": 47475519, "url": "https://news.ycombinator.com/item?id=47475519", "by": "jolux", "date": "2026-03-22", "version": null, "stance": "recommend", "quote": "it has found several real vulnerabilities for me before", "excerpt": "Sonarqube did not flag public fields as a security issue by default the last time I used it \u2014 however it has found several real vulnerabilities for me before.", "context": "", "use_case": "Finding security vulnerabilities", "switched_from": "", "story": "Delve \u2013 Fake Compliance as a Service"}, {"id": 756772928, "item_id": 47298308, "url": "https://news.ycombinator.com/item?id=47298308", "by": "youknownothing", "date": "2026-03-08", "version": null, "stance": "recommend", "quote": "quality control systems (e.g. SonarQube)", "excerpt": "From my experience, you can't trust the agent to do the entire thing unless you set up very heavy linters, quality control systems (e.g. SonarQube) and a long etc. of things because AI tends to produce pretty bad code: repetition, unused code, lack of structure... basically all the things that we've spent decades learning not to do. And then there is the point where you get a pretty obscure bug that you can only solv", "context": "", "use_case": "Code quality scanning", "switched_from": "", "story": "A standard protocol to handle and discard low-effort, AI-Generated pull requests"}, {"id": 752702960, "item_id": 47043935, "url": "https://news.ycombinator.com/item?id=47043935", "by": "kristopolous", "date": "2026-02-16", "version": null, "stance": "recommend", "quote": "this looks to be a mass adopted fortune-100 product", "excerpt": "eh, it sounds like you're hawking your own product. It doesn't look like you are and this looks to be a mass adopted fortune-100 product without large brand name awareness, but that's the risk with hn. There's a lot of people trying to hustle their stuff on here. Strongly frowned upon unless it's genuinely free and even then... Maybe something like \"at work we use something called sonarqube and I've been using it on ", "context": "", "use_case": "", "switched_from": "", "story": "AI is destroying Open Source, and it's not even good yet"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 796818608, "item_id": 49801163, "url": "https://news.ycombinator.com/item?id=49801163", "by": "bunderbunder", "date": "2026-09-22", "version": null, "stance": "warn", "quote": "And it scores the SonarQube metrics even worse, with only a 0.35 correlation", "excerpt": "Plenty of measurements exist, but the trick, as the article said, is finding good measurements. Cyclomatic complexity has been pretty solidly discredited within the maintainability research community for decades. Sonar's cognitive complexity metric is a bit better, but here's a study that found that it still only has about a 0.5 correlation with how much difficulty programmers actually had reading code as measured by", "context": "", "use_case": "", "switched_from": "", "story": "AI Has No Wisdom and Neither Will You"}, {"id": 795641361, "item_id": 49727585, "url": "https://news.ycombinator.com/item?id=49727585", "by": "paimapi", "date": "2026-09-16", "version": null, "stance": "warn", "quote": "I don't think existing toolsets are really great at actually measuring code quality", "excerpt": "I think the future of development will be a lot of automated quality checks like these on AI-drafted code that humans review and ensures that it doesn't muck up the business logic and actually fulfills the acceptance criteria. that said, I don't think existing toolsets are really great at actually measuring code quality I've been in the process of reviewing and validating a lot of tools like this (qlty, Sonarqube, fa", "context": "", "use_case": "", "switched_from": "", "story": "ImpactGate: A merge gate that scores the structural decay AI adds"}, {"id": 749665427, "item_id": 46854089, "url": "https://news.ycombinator.com/item?id=46854089", "by": "bumahkib7", "date": "2026-02-02", "version": null, "stance": "warn", "quote": "tired of waiting 5\u201320 minutes for Semgrep/CodeQL/SonarQube", "excerpt": "I built RMA because I was tired of waiting 5\u201320 minutes for Semgrep/CodeQL/SonarQube on large monorepos. It's a Rust-native CLI that scans ~100k LOC in under 0.5 seconds and now has: - Cross-file taint propagation (input in handler \u2192 util \u2192 sink) - String concatenation & template taint (real SQLi, XSS, command injection, path traversal) - Basic type inference + nullability (null dereference detection) - Typestate/pro", "context": "", "use_case": "", "switched_from": "", "story": "RMA \u2013 Fast Rust monorepo scanner cross-file taint, typestate, <0.5s on 100k LOC"}]}], "who": [{"by": "bemeeker", "context": "solo maintainer", "url": "https://news.ycombinator.com/item?id=50131519", "date": "2026-10-17"}, {"by": "ellingsworth", "context": "product & application security leader with 15+ years", "url": "https://news.ycombinator.com/item?id=47236121", "date": "2026-03-03"}], "tags": [], "use_cases": ["code quality scanning", "code analysis", "code quality checks", "static analysis", "code-quality dashboard", "code quality, listed skill"], "compared": [{"slug": "claude-code", "name": "Claude Code", "co": 3, "switched_from": 0, "switched_to": 0}, {"slug": "tmux", "name": "tmux", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "github-actions", "name": "GitHub Actions", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "cursor", "name": "Cursor", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [], "threads": [{"url": "https://news.ycombinator.com/item?id=50131518", "title": "Ask HN: How are you all ensuring your AI code isn't slop?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49922568", "title": "Ask HN: Who wants to be hired? (October 2026)", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49944392", "title": "The era of software quality, or the era of ostriches?", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49799965", "title": "AI Has No Wisdom and Neither Will You", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49726329", "title": "ImpactGate: A merge gate that scores the structural decay AI adds", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49156682", "title": "Ask HN: Who wants to be hired? (August 2026)", "mentions": 1}], "sentiment_by_month": {"2025-11": {"neutral": 1}, "2025-12": {}, "2026-01": {}, "2026-02": {"warn": 1, "recommend": 1}, "2026-03": {"neutral": 1, "recommend": 2}, "2026-04": {}, "2026-05": {}, "2026-06": {"neutral": 2}, "2026-07": {}, "2026-08": {"neutral": 1}, "2026-09": {"warn": 2}, "2026-10": {"neutral": 3}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 802104306, "item_id": 50131519, "url": "https://news.ycombinator.com/item?id=50131519", "by": "bemeeker", "date": "2026-10-17", "version": null, "stance": "neutral", "quote": "I\u2019m also using SonarQube and CodeRabbit", "excerpt": "I\u2019ve been working on an open source project called Pando (https://github.com/trypando/pando), which is meant to help alleviate \u201cShadow AI\u201d vibecoded apps in workplaces, and give employees an outlet for what they build. With that said, it\u2019s a big project and I\u2019m a solo maintainer right now, and as a result I\u2019m using AI for much of the development process. Obviously this isn\u2019t new. AWS, Google, Meta, and pretty much ev", "context": "solo maintainer", "use_case": "code quality checks", "switched_from": "", "story": "Ask HN: How are you all ensuring your AI code isn't slop?"}, {"id": 799605106, "item_id": 49975319, "url": "https://news.ycombinator.com/item?id=49975319", "by": "perend", "date": "2026-10-06", "version": null, "stance": "neutral", "quote": "security tooling (SAST/DAST, Wiz, Nuclei, SonarQube)", "excerpt": "Senior DevOps / DevSecOps Engineer (8 YoE, full-stack background) - AWS, Terraform, CI/CD, Python, Postgres Location: France (CET) Remote: Yes (worked async with a US scale-up for 5 years) Willing to relocate: No Technologies: AWS (ECS Fargate, RDS), Terraform, Docker, Kubernetes/Helm, CI/CD (GitHub Actions, GitLab CI), Python (FastAPI, Flask, aiohttp), PostgreSQL/PostGIS, Redis, React, security tooling (SAST/DAST, W", "context": "", "use_case": "Code quality scanning", "switched_from": "", "story": "Ask HN: Who wants to be hired? (October 2026)"}, {"id": 799559568, "item_id": 49972473, "url": "https://news.ycombinator.com/item?id=49972473", "by": "bunderbunder", "date": "2026-10-06", "version": null, "stance": "neutral", "quote": "when I was working on a project where we used Sonarqube, we ended up deciding as a team that we'd prefer changing the code to eliminate false positives", "excerpt": "To the point about LLMs being the only method to harden software - that's why I'm not sure I'm convinced by the argument. The article says the bulk of the defects were integer overflow bugs. This is out of my league a bit, but that feels like the kind of thing that should be detectable with static analysis, possibly both less expensively and more reliably than with LLMs. For example: https://link.springer.com/article", "context": "", "use_case": "static analysis", "switched_from": "", "story": "The era of software quality, or the era of ostriches?"}, {"id": 796818608, "item_id": 49801163, "url": "https://news.ycombinator.com/item?id=49801163", "by": "bunderbunder", "date": "2026-09-22", "version": null, "stance": "warn", "quote": "And it scores the SonarQube metrics even worse, with only a 0.35 correlation", "excerpt": "Plenty of measurements exist, but the trick, as the article said, is finding good measurements. Cyclomatic complexity has been pretty solidly discredited within the maintainability research community for decades. Sonar's cognitive complexity metric is a bit better, but here's a study that found that it still only has about a 0.5 correlation with how much difficulty programmers actually had reading code as measured by", "context": "", "use_case": "", "switched_from": "", "story": "AI Has No Wisdom and Neither Will You"}, {"id": 795641361, "item_id": 49727585, "url": "https://news.ycombinator.com/item?id=49727585", "by": "paimapi", "date": "2026-09-16", "version": null, "stance": "warn", "quote": "I don't think existing toolsets are really great at actually measuring code quality", "excerpt": "I think the future of development will be a lot of automated quality checks like these on AI-drafted code that humans review and ensures that it doesn't muck up the business logic and actually fulfills the acceptance criteria. that said, I don't think existing toolsets are really great at actually measuring code quality I've been in the process of reviewing and validating a lot of tools like this (qlty, Sonarqube, fa", "context": "", "use_case": "", "switched_from": "", "story": "ImpactGate: A merge gate that scores the structural decay AI adds"}, {"id": 786655305, "item_id": 49165956, "url": "https://news.ycombinator.com/item?id=49165956", "by": "zs1m", "date": "2026-08-04", "version": null, "stance": "neutral", "quote": "SonarQube + Jenkins CI", "excerpt": "Location: Nanjing, China Remote: Yes, actively seeking overseas remote roles Willing to relocate: Yes, for the right opportunity Technologies: React 19, TypeScript, Vite, TailwindCSS, Zustand, TanStack Query, React Router, shadcn/ui, SSE/streaming UI, Vue 2/3, Angular (migration), Three.js/React Three Fiber, Echarts, AntV G6, Grafana plugin dev, i18n, SonarQube + Jenkins CI R\u00e9sum\u00e9/CV: https://contrails.space/en (blog", "context": "", "use_case": "Code-quality dashboard", "switched_from": "", "story": "Ask HN: Who wants to be hired? (August 2026)"}, {"id": 775635665, "item_id": 48477229, "url": "https://news.ycombinator.com/item?id=48477229", "by": "nimblist", "date": "2026-06-10", "version": null, "stance": "neutral", "quote": "SonarQube carries out analysis on all code merged to main.", "excerpt": "For me right now it's this but I'm constantly learning new approaches/improvements Claude Code running on a dedicated debian lxc with tmux so I can pick sessions up from any machine. The key thing for me is to ensure that claude is constantly maintaining its own project documentation so that it's not reliant on any one session context. I've also set up custom commands to set up a clearly defined plan md file and to i", "context": "", "use_case": "code analysis", "switched_from": "", "story": "Ask HN: What is the AI setup for an experienced dev starting on a new project?"}, {"id": 775633009, "item_id": 48477063, "url": "https://news.ycombinator.com/item?id=48477063", "by": "nimblist", "date": "2026-06-10", "version": null, "stance": "neutral", "quote": "SonarQube carries out analysis on all code merged to main.", "excerpt": "Claude Code running on a dedicated debian lxc with tmux so I can pick sessions up from any machine. The key thing for me is to ensure that claude is constantly maintaining its own project documentation so that it's not reliant on any one session context. I've also set up custom commands to set up a clearly defined plan md file and to incrementally step through it updating completion as it goes. From my perspective it", "context": "", "use_case": "code analysis", "switched_from": "", "story": "Ask HN: What is your (AI) dev tech stack / workflow? (June 2026)"}, {"id": 773779779, "item_id": 48361236, "url": "https://news.ycombinator.com/item?id=48361236", "by": "ellingsworth", "date": "2026-06-01", "version": null, "stance": "neutral", "quote": "", "excerpt": "My name is John, I am a product & application security leader with 15+ years building software security programs, core team member & co-author of OWASP SAMM, specializing in security transformation, Security Champions networks, and embedding security practices into engineering culture. Looking to help new & established delivery teams merge security into their solutions thoughtfully & reasonably. Location: Maine, Unit", "context": "", "use_case": "code quality, listed skill", "switched_from": "", "story": "Ask HN: Who wants to be hired? (June 2026)"}, {"id": 759608304, "item_id": 47475519, "url": "https://news.ycombinator.com/item?id=47475519", "by": "jolux", "date": "2026-03-22", "version": null, "stance": "recommend", "quote": "it has found several real vulnerabilities for me before", "excerpt": "Sonarqube did not flag public fields as a security issue by default the last time I used it \u2014 however it has found several real vulnerabilities for me before.", "context": "", "use_case": "Finding security vulnerabilities", "switched_from": "", "story": "Delve \u2013 Fake Compliance as a Service"}, {"id": 756772928, "item_id": 47298308, "url": "https://news.ycombinator.com/item?id=47298308", "by": "youknownothing", "date": "2026-03-08", "version": null, "stance": "recommend", "quote": "quality control systems (e.g. SonarQube)", "excerpt": "From my experience, you can't trust the agent to do the entire thing unless you set up very heavy linters, quality control systems (e.g. SonarQube) and a long etc. of things because AI tends to produce pretty bad code: repetition, unused code, lack of structure... basically all the things that we've spent decades learning not to do. And then there is the point where you get a pretty obscure bug that you can only solv", "context": "", "use_case": "Code quality scanning", "switched_from": "", "story": "A standard protocol to handle and discard low-effort, AI-Generated pull requests"}, {"id": 755777939, "item_id": 47236121, "url": "https://news.ycombinator.com/item?id=47236121", "by": "ellingsworth", "date": "2026-03-03", "version": null, "stance": "neutral", "quote": "SonarQube, Aqua Security", "excerpt": "My name is John, I am a product & application security leader with 15+ years building software security programs, core team member & co-author of OWASP SAMM, specializing in security transformation, Security Champions networks, and embedding security into engineering culture. Looking to help new & established delivery teams merge security into their solutions thoughtfully & reasonably. Location: Maine, United States ", "context": "product & application security leader with 15+ years", "use_case": "Code quality scanning", "switched_from": "", "story": "Ask HN: Who wants to be hired? (March 2026)"}, {"id": 752702960, "item_id": 47043935, "url": "https://news.ycombinator.com/item?id=47043935", "by": "kristopolous", "date": "2026-02-16", "version": null, "stance": "recommend", "quote": "this looks to be a mass adopted fortune-100 product", "excerpt": "eh, it sounds like you're hawking your own product. It doesn't look like you are and this looks to be a mass adopted fortune-100 product without large brand name awareness, but that's the risk with hn. There's a lot of people trying to hustle their stuff on here. Strongly frowned upon unless it's genuinely free and even then... Maybe something like \"at work we use something called sonarqube and I've been using it on ", "context": "", "use_case": "", "switched_from": "", "story": "AI is destroying Open Source, and it's not even good yet"}, {"id": 749665427, "item_id": 46854089, "url": "https://news.ycombinator.com/item?id=46854089", "by": "bumahkib7", "date": "2026-02-02", "version": null, "stance": "warn", "quote": "tired of waiting 5\u201320 minutes for Semgrep/CodeQL/SonarQube", "excerpt": "I built RMA because I was tired of waiting 5\u201320 minutes for Semgrep/CodeQL/SonarQube on large monorepos. It's a Rust-native CLI that scans ~100k LOC in under 0.5 seconds and now has: - Cross-file taint propagation (input in handler \u2192 util \u2192 sink) - String concatenation & template taint (real SQLi, XSS, command injection, path traversal) - Basic type inference + nullability (null dereference detection) - Typestate/pro", "context": "", "use_case": "", "switched_from": "", "story": "RMA \u2013 Fast Rust monorepo scanner cross-file taint, typestate, <0.5s on 100k LOC"}, {"id": 737420065, "item_id": 46088754, "url": "https://news.ycombinator.com/item?id=46088754", "by": "snowfield", "date": "2025-11-29", "version": null, "stance": "neutral", "quote": "I use some guardrails, like SonarQube as static code analyzer", "excerpt": "Agreed, I know Networks, requests, protocols, Auth flow etc but is been years since I actually coded stuff This is magical to me. I love cursor, I use it to deploy docker packages and fix npm issues etc too :p I use some guardrails, like SonarQube as static code analyzer and of course some default linters. Checks and balances", "context": "", "use_case": "static code analysis", "switched_from": "", "story": "Google CEO Pushes 'Vibe Coding' \u2013 But Real Developers Know It's Not Magic"}]}