Complete Guide to SonarQube for Static Analysis (2026)

SonarQube analyzes source code against quality and security rules, then turns the results into quality gates for branches and pull requests. It comes as managed Cloud, self-hosted Server, and a free Community Build with a narrower workflow. The difficult buying questions sit around plan boundaries, language coverage, AI features, and the separate Advanced Security subscription.

Product facts and public prices verified against official sources on July 28, 2026.

At a Glance

Requirement	Starting Point
Managed private project	Cloud Free
Managed pull request gate	Cloud Team
Self-hosted main branch	Community Build
Self-hosted pull request gate	Server Developer
Dependency analysis	Advanced Security
AI fix suggestions	Paid plan

What SonarQube Analyzes

SonarQube performs static analysis, which means a scanner reads source and configuration files without observing the deployed application at runtime. The scanner applies the rules in a language's quality profile, then sends the results to Cloud, Server, or Community Build for storage and quality-gate calculation.

Sonar provides scanners for common build systems and languages, including .NET, Maven, Gradle, npm, and Python. A general SonarScanner CLI covers projects that do not use one of the dedicated scanners.

Findings are grouped as security, reliability, and maintainability issues, with security hotspots kept for patterns that need human review. A hotspot asks a reviewer to decide whether the code is safe in its context. Treating every hotspot as a confirmed vulnerability would inflate the queue and hide the distinction Sonar intends.

Core security includes taint analysis, which follows untrusted data from a source toward a sensitive sink. Sonar also lists infrastructure-as-code scanning and secrets detection in the core product. The exact rules still vary by language and edition.

SonarQube does not execute the application as a dynamic scanner would. A static rule can identify an unsafe data flow in code, while runtime authorization mistakes, network controls, and deployment behavior need other tests. Keep that boundary clear when building an application security stack.

Cloud, Server, and Community Build

SonarQube Cloud provides the managed version of the analysis service. It connects to GitHub, GitLab, Bitbucket Cloud, or Azure DevOps and stores the results without a SonarQube server to operate. The current plans are Free, Team, and Enterprise, plus a separate open-source plan for public projects.

SonarQube Server is the commercial self-hosted product. The customer manages the application, database, upgrades, backups, network access, and scanner connectivity. Developer, Enterprise, and Data Center editions add capacity and features at different line-of-code thresholds.

SonarQube Community Build is the free self-hosted option. It provides automated review of the main branch and works as a central baseline when the team can accept that branch limit.

Deployment	Hosting	Entry Limit
Cloud Free	Sonar	50K private LOC
Cloud Team	Sonar	100K private LOC
Community Build	Customer	Main branch
Server Developer	Customer	100K LOC

The choice changes more than who runs the server. It changes branch analysis, pull request feedback, language coverage, identity controls, and the work required to keep the analysis service available. Include those operational costs when comparing Server with Cloud.

Quality Profiles and Gates

A quality profile selects the rules applied to each language. A quality gate evaluates the resulting measures and returns Passed or Failed. Sonar names its built-in defaults Sonar way and lets paid plans extend them according to plan entitlement.

The gate becomes useful when the CI or repository ruleset treats its status as a merge condition. A failure can come from a new reliability issue, a security finding, an unreviewed hotspot, coverage, or duplication, depending on the configured conditions. The gate itself does not merge or fix code.

Sonar's new-code model separates findings introduced by current work from debt that already exists. A team can enforce strict rules on changed code while keeping an owned backlog for older findings. That makes adoption possible without granting permanent exceptions to every old issue.

Start with the built-in gate on one representative project. Record which findings block a pull request, who can mark a hotspot reviewed, and how an exception expires. A gate with no response owner becomes a red status developers learn to route around.

Custom quality gates and profiles depend on the plan. SonarQube Cloud provides them on Team and Enterprise, while Cloud Free applies the built-in Sonar standards.

Pull Request Analysis

SonarQube Cloud pull request analysis compares the pull request head with the target branch and reports issues introduced by that change. An up-to-date target-branch analysis is required for an accurate comparison.

On eligible plans, the result appears in SonarQube and can decorate the pull request in GitHub, GitLab, Azure DevOps, or Bitbucket Cloud. Depending on the repository platform, findings may also appear as inline annotations. Repository rules can block the merge when the quality gate fails.

Cloud Free analyzes the main branch and exposes pull request analysis only after the change has merged into main. It cannot supply a pre-merge pull request gate. Cloud Team and Enterprise provide pre-merge analysis, while the OSS plan provides unlimited branch and pull request analysis for eligible open-source organizations.

Community Build confines automated analysis to the repository's main branch. Commercial Server editions add branch and pull request workflows, with Developer as the entry edition shown on the current pricing page. A team that needs pre-merge enforcement should include that edition boundary in the Server cost.

Pull request analysis focuses on new code. Main-branch analysis still matters because it can apply broader rules and keeps the comparison base current. Schedule both paths instead of assuming an inline comment is the whole result.

Core Security and Advanced Security

Core SonarQube security covers first-party source and configuration. Sonar lists static application security testing, cross-file taint analysis, infrastructure-as-code rules, and exposed-secret detection. Cloud secret detection runs on files processed by language analyzers unless the scope is changed.

Advanced Security adds software composition analysis and advanced static analysis across dependency boundaries. Sonar documents dependency vulnerabilities, malicious packages, license policy, software bill of materials exports, and dependency-aware data flow among the add-on's capabilities.

Advanced Security plan wording needs careful procurement review before purchase. Sonar's Cloud documentation says the add-on requires a separate Enterprise subscription.

The current marketing page says availability on Cloud Team and Enterprise. Get the exact Cloud entitlement and price in writing before treating either line as the contract.

For self-hosted Server, Advanced Security is an add-on starting with Enterprise. SCA must be enabled, and the built project must expose supported dependency files for analysis.

Sonar's SCA is a documented dependency scanner, but the team still needs to test the supported package managers and malicious-package policy against its own stack. Keep Dependabot alerts or another advisory source active during the evaluation so one product trial does not create a gap in the existing queue.

AI Code Assurance and CodeFix

AI Code Assurance applies a stricter quality standard to projects marked as containing AI-generated code. It uses project labels, an AI-qualified quality gate, and a badge for projects that meet the chosen standard.

The control analyzes code with Sonar rules after the project is labelled. It does not prove authorship for each line or replace review of generated changes. Automatic GitHub Copilot detection is deprecated in the current Cloud and Server documentation, so a lasting workflow should use explicit project policy rather than depend on that signal.

AI CodeFix generates a proposed edit for eligible findings. Cloud Team and Enterprise provide it for selected rules and languages. The developer can inspect the diff in SonarQube or a connected IDE before applying it.

On self-hosted Server, AI CodeFix requires Enterprise or Data Center. When Sonar's hosted model path is used, an affected code snippet and issue description are sent to the chosen model service. Review data-handling terms and language eligibility before enabling the feature on sensitive repositories.

Every suggested fix still needs a focused test before it is accepted. Reproduce the reported issue, apply the smallest eligible edit, run the security regression, and rescan with SonarQube. The final evidence is a closed finding plus preserved behavior.

Limits and Review Noise

Static analysis sees code and configuration rather than runtime state. Authorization behavior, deployment identity, network policy, and attacks that depend on live data need dynamic tests or runtime controls. SonarQube should own the source-analysis lane instead of becoming a label for every security check.

Security hotspots require human judgment by design. Assign reviewers who understand the framework and threat behind each hotspot category. Closing them in bulk to make a gate green removes the review that the feature is meant to require.

Legacy findings can bury a new rollout. Sonar's new-code model gives teams a way to enforce current changes while they triage the backlog. Set an owner and service level for old high-severity findings, then expand the gate after measuring how much review work the initial scan creates.

Language counts and analyzer coverage differ between SonarQube plans. The current Cloud pricing page advertises more than 30 languages on Team and more than 40 on Enterprise.

Server Developer lists 34, while Server Enterprise lists 40. Check the exact language and rule set instead of buying from the headline count.

Advanced Security has its own rollout cost. Dependency analysis can create a large first backlog, and Sonar recommends starting with one willing team before adding dependency-risk gate conditions.

Pricing

Sonar prices private analysis by lines of code rather than scan frequency. Only private-project lines count toward the Cloud limit, and the largest branch determines a project's billed line count.

SonarQube Cloud

Cloud Team starts at $34 per month for up to 100,000 private lines of code. Free covers up to 50,000 private lines, while Enterprise uses custom annual pricing and a wider feature set.

Plan	Starting Price	Plan Scope
Free	$0	50K LOC; post-merge PRs
Team	$34/month	100K+ LOC; PR gates
Enterprise	Custom	Unlimited option; enterprise controls
OSS	$0	Eligible public projects

Team includes secrets detection, pull request analysis, AI CodeFix, and the current Team language set. Enterprise adds organization hierarchy, SSO and SCIM, broader languages, portfolio controls, security reports, and other governance features listed on the plan page.

SonarQube Server

Server Developer starts at $750 per instance each year. Enterprise and Data Center use sales quotes. The license covers a maximum line count for one installation.

Edition	Annual Price	Edition Scope
Community Build	$0	Core set; main branch
Developer	From $750	34 languages; branch analysis
Enterprise	Custom	40 languages; AI CodeFix
Data Center	Custom	40 languages; high availability

Server cost includes the license plus the infrastructure and staff time for upgrades, backups, monitoring, database care, and incident response. Compare that full annual figure with Cloud instead of treating self-hosting as free after the license is paid.

A Safe Rollout

A SonarQube trial should prove that the rules fit the codebase and that the team can act on the findings. Start with one representative repository and an owner from both engineering and security.

1. Choose the deployment. Decide whether code and analysis data may leave the network before comparing features.
2. Verify the language. Check the exact analyzer, framework rules, and edition on the current support page.
3. Scan the main branch. Classify true findings, false positives, hotspots, and existing debt before enabling a gate.
4. Set the new-code baseline. Keep current pull requests strict while assigning the old backlog to a separate plan.
5. Protect one pull request. Confirm decoration, inline findings, status checks, and the exception path on a test branch.
6. Test an eligible fix. Apply an AI CodeFix only after adding a regression test for the reported issue.
7. Price the final scope. Count private lines, Server operations, Advanced Security, and commercial help in one annual figure.

Keep the first gate narrow enough that developers trust it. Expand rule coverage after the team can explain each blocked merge and resolve it without bypassing the check.

The Verdict

Choose SonarQube when static analysis needs a documented quality gate across supported languages and the organization wants either SonarQube Cloud or customer-managed Server deployment. Cloud Free and Community Build provide main-branch baselines. Pre-merge pull request analysis requires Cloud Team, Cloud Enterprise, an eligible OSS plan, or a qualifying Server edition.

Buy from the documented edition boundary rather than the SonarQube name alone. Confirm language rules, branch coverage, AI CodeFix data handling, and Advanced Security entitlement against a representative repository. Choose SonarQube for first-party code and quality governance, then keep separate dependency and runtime controls where the selected plan does not cover them.

FAQ

Does SonarQube Cloud Free analyze pull requests?

Cloud Free exposes pull request analysis only after the pull request has merged into main, so it cannot protect a merge with a pre-merge gate. Cloud Team and Enterprise provide pre-merge pull request analysis. The separate OSS plan provides it for eligible open-source organizations.

Does SonarQube Community Build include pull request analysis?

SonarQube Community Build focuses on automated analysis of the main branch. Its comparison table places multi-branch and pull request analysis in other deployments. Use Community Build for a self-hosted main-branch baseline, then price Server Developer when pre-merge branch analysis is required.

Which plans include SonarQube AI CodeFix?

Sonar documents AI CodeFix on Cloud Team and Enterprise. On self-hosted Server, it requires Enterprise or Data Center. The feature covers selected rules and languages, sends an affected code snippet to the chosen model service, and applies monthly usage limits when Sonar hosts the model path.

Does SonarQube include software composition analysis?

Software composition analysis comes through SonarQube Advanced Security. Current Cloud documentation describes it as a separate Enterprise subscription, while Server documentation makes it an add-on starting with Enterprise. Confirm the exact Cloud entitlement in writing because Sonar's marketing page also mentions Team availability.

Can SonarQube replace Dependabot alerts?

Keep Dependabot alerts for GitHub Advisory Database findings and automated security updates. Core SonarQube analyzes first-party source, secrets, and infrastructure code, while Advanced Security adds dependency analysis under different plan and rollout requirements. Assign each alert source an owner instead of assuming one queue covers every dependency risk.

Where to Go Next

• Application Security hub
• Snyk guide
• Socket guide
• Dependabot guide
• Aikido vs SonarQube