SonarQube
Fewer than 5 people recommend it so far, so there's no written verdict. Here is what commenters said.
3recommend
2warn against
Nov 29, 2025first mention
Oct 17, 2026latest mention
Why people recommend it
“it has found several real vulnerabilities for me before”
“quality control systems (e.g. SonarQube)”
Show 1 more
“this looks to be a mass adopted fortune-100 product”
Caveats and dissent
“And it scores the SonarQube metrics even worse, with only a 0.35 correlation”
“I don't think existing toolsets are really great at actually measuring code quality”
Show 1 more
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube”
Often compared with
Who recommends it in their own words
Threads where it came up
- Ask HN: How are you all ensuring your AI code isn't slop? 1 mention
- Ask HN: Who wants to be hired? (October 2026) 1 mention
- The era of software quality, or the era of ostriches? 1 mention
- AI Has No Wisdom and Neither Will You 1 mention
- ImpactGate: A merge gate that scores the structural decay AI adds 1 mention
- Ask HN: Who wants to be hired? (August 2026) 1 mention
Data: sonarqube.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 15
“I’m also using SonarQube and CodeRabbit”
“security tooling (SAST/DAST, Wiz, Nuclei, SonarQube)”
“when I was working on a project where we used Sonarqube, we ended up deciding as a team that we'd prefer changing the code to eliminate false positives”
“And it scores the SonarQube metrics even worse, with only a 0.35 correlation”
“I don't think existing toolsets are really great at actually measuring code quality”
“SonarQube + Jenkins CI”
“SonarQube carries out analysis on all code merged to main.”
“SonarQube carries out analysis on all code merged to main.”
My name is John, I am a product & application security leader with 15+ years building software security programs, core team member & co-author of OWASP SAMM, specializing in security transformation, Security Champions networks, and embedding security practices into engineering culture. Looking to help new & established delivery teams merge security into their solutions thoughtfully & reasonably. Location: Maine, Unit
“it has found several real vulnerabilities for me before”
“quality control systems (e.g. SonarQube)”
“SonarQube, Aqua Security”
“this looks to be a mass adopted fortune-100 product”
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube”
“I use some guardrails, like SonarQube as static code analyzer”