Complete Guide to SonarQube for Static Analysis (2026)

SonarQube analyzes source code against quality and security rules, then turns the results into quality gates for branches and pull requests. It comes as managed Cloud, self-hosted Server, and a free Community Build with a narrower workflow. Choose Cloud Team or a commercial Server edition when you need a pre-merge pull request gate, because the free options gate only the main branch.

At a Glance

Requirement	Starting Point
Managed private project	Cloud Free
Managed pull request gate	Cloud Team
Self-hosted main branch	Community Build
Self-hosted pull request gate	Server Developer
Dependency analysis	Advanced Security
AI fix suggestions	Paid plan

What Does SonarQube Analyse?

SonarQube performs static analysis, which means a scanner reads source and configuration files without observing the deployed application at runtime. The scanner applies the rules in a language's quality profile, then sends the results to Cloud, Server, or Community Build for storage and quality-gate calculation.

Sonar provides scanners for common build systems and languages, including .NET, Maven, Gradle, npm, and Python. A general SonarScanner CLI covers projects that do not use one of the dedicated scanners.

Findings are grouped as security, reliability, and maintainability issues, with security hotspots kept for patterns that need human review. A hotspot asks a reviewer to decide whether the code is safe in its context. Treating every hotspot as a confirmed vulnerability would inflate the queue and hide the distinction Sonar intends.

Core security includes taint analysis, which follows untrusted data from its source to operations where it could cause a security flaw. Sonar also lists infrastructure-as-code scanning and secrets detection in the core product. The exact rules still vary by language and edition.

SonarQube does not execute the application as a dynamic scanner would. A static rule can identify an unsafe data flow in code, while runtime authorization mistakes, network controls, and deployment behavior need other tests. Keep that boundary clear when building an application security stack.

Should You Choose SonarQube Cloud, Server or Community Build?

Choose SonarQube Cloud when you want Sonar to operate the service, Server when you need a commercial self-hosted deployment, or Community Build when free main-branch analysis is sufficient. The choice affects pull request support, language coverage and maintenance work as well as hosting.

SonarQube Server is the commercial self-hosted product. The customer manages the application, database, upgrades, backups, network access, and scanner connectivity. Developer, Enterprise, and Data Center editions add capacity and features at different line-of-code thresholds.

SonarQube Community Build is the free self-hosted option. It provides automated review of the main branch and works as a central baseline when the team can accept that branch limit.

Deployment	Hosting	Entry Limit
Cloud Free	Sonar	50K private LOC
Cloud Team	Sonar	100K private LOC
Community Build	Customer	Main branch
Server Developer	Customer	100K LOC

The choice changes more than who runs the server. It changes branch analysis, pull request feedback, language coverage, identity controls, and the work required to keep the analysis service available. Include those operational costs when comparing Server with Cloud.

How Do SonarQube Quality Profiles and Gates Work?

A SonarQube quality profile chooses the rules for a language; a quality gate checks the resulting measures and returns Passed or Failed. Configure CI or repository rules to require that status when a failed gate should block a merge.

The gate becomes useful when the CI or repository ruleset treats its status as a merge condition. A failure can come from a new reliability issue, a security finding, an unreviewed hotspot, coverage, or duplication, depending on the configured conditions. The gate itself does not merge or fix code.

Sonar's new-code model separates findings introduced by current work from debt that already exists. A team can enforce strict rules on changed code while keeping an owned backlog for older findings. That makes adoption possible without granting permanent exceptions to every old issue.

Start with the built-in gate on one representative project. Record which findings block a pull request, who can mark a hotspot reviewed, and how an exception expires. If nobody fixes the findings that fail a gate, developers may start bypassing it.

Custom quality gates and profiles depend on the plan. SonarQube Cloud provides them on Team and Enterprise, while Cloud Free applies the built-in Sonar standards.

How Does SonarQube Analyse Pull Requests?

SonarQube Cloud pull request analysis compares the pull request head with the target branch and reports issues introduced by that change. An up-to-date target-branch analysis is required for an accurate comparison.

On eligible plans, the result appears in SonarQube and can decorate the pull request in GitHub, GitLab, Azure DevOps, or Bitbucket Cloud. Depending on the repository platform, findings may also appear as inline annotations. Repository rules can block the merge when the quality gate fails.

Cloud Free analyzes the main branch and exposes pull request analysis only after the change has merged into main. It cannot supply a pre-merge pull request gate. Cloud Team and Enterprise provide pre-merge analysis, while the OSS plan provides unlimited branch and pull request analysis for eligible open-source organizations.

Community Build confines automated analysis to the repository's main branch. Commercial Server editions add branch and pull request workflows, with Developer as the entry edition shown on the current pricing page. A team that needs pre-merge enforcement should include that edition boundary in the Server cost.

Pull request analysis focuses on new code. Main-branch analysis still matters because it can apply broader rules and keeps the comparison base current. Schedule both paths instead of assuming an inline comment is the whole result.

What Does SonarQube Advanced Security Add?

SonarQube Advanced Security adds dependency analysis to core source-code checks, including known vulnerabilities, malicious packages, licence policies and software bills of materials. Its availability and subscription terms differ between Cloud and Server, so confirm the entitlement for your deployment.

Advanced Security adds software composition analysis and advanced static analysis across dependency boundaries. Sonar documents dependency vulnerabilities, malicious packages, license policy, software bill of materials exports, and dependency-aware data flow among the add-on's capabilities.

Sonar's Cloud documentation says the product is available starting with the Team plan and requires a separate subscription that neither Team nor Enterprise includes.

Sonar's pricing page also disagrees with itself. The Team card lists Advanced Security among its inclusions, while the same page's FAQ says it is available to Enterprise plan users. Get the exact Cloud entitlement and price in writing before treating any of these lines as the contract.

For self-hosted Server, Advanced Security is an add-on starting with Enterprise. SCA must be enabled, and the built project must expose supported dependency files for analysis.

Sonar's SCA is a documented dependency scanner, but the team still needs to test the supported package managers and malicious-package policy against its own stack. Keep Dependabot alerts or another advisory source active during the evaluation so one product trial does not create a gap in the existing queue.

How Does SonarQube Check and Fix AI-Generated Code?

SonarQube AI Code Assurance applies a quality standard to projects marked as containing AI-generated code. AI CodeFix separately suggests edits for eligible findings. Neither feature proves who wrote every line or removes the need to review and test a change.

The control analyzes code with Sonar rules after the project is labeled. It does not prove authorship for each line or replace review of generated changes. Automatic GitHub Copilot detection is deprecated in the current Cloud and Server documentation, so a lasting workflow should use explicit project policy rather than depend on that signal.

AI CodeFix generates a proposed edit for eligible findings. Cloud Team and Enterprise provide it for selected rules and languages. The developer can inspect the diff in SonarQube or a connected IDE before applying it.

On self-hosted Server, AI CodeFix requires Enterprise or Data Center. When Sonar's hosted model path is used, an affected code snippet and issue description are sent to the chosen model service. Review data-handling terms and language eligibility before enabling the feature on sensitive repositories.

Every suggested fix still needs a focused test before it is accepted. Reproduce the reported issue, apply the smallest eligible edit, run the security regression, and rescan with SonarQube. Check that the finding is resolved and the application still behaves as intended.

What Are SonarQube’s Limits?

SonarQube’s static analysis does not observe the running application. Runtime authorisation, deployment identity, network policy and attacks involving live data need other tests or controls. Language support, branch analysis and advanced features also depend on the edition.

Security hotspots require human judgment by design. Assign reviewers who understand the framework and threat behind each hotspot category. Closing them in bulk to make a gate green removes the review that the feature is meant to require.

Legacy findings can bury a new rollout. Sonar's new-code model gives teams a way to enforce current changes while they triage the backlog. Set an owner and service level for old high-severity findings, then expand the gate after measuring how much review work the initial scan creates.

Language counts and analyzer coverage differ between SonarQube plans. The current Cloud pricing page advertises more than 30 languages on Team and more than 40 on Enterprise.

Server Developer and Enterprise also have different language sets. Check the exact language and rule set instead of buying from the headline count.

Advanced Security has its own rollout cost. Dependency analysis can create a large first backlog, and Sonar recommends starting with one willing team before adding dependency-risk gate conditions.

How Much Does SonarQube Cost?

SonarQube Cloud offers a free tier for up to 50,000 private lines of code, with Team starting at $34 per month for 100,000 private lines. Commercial Server pricing is quoted per instance and year by line count. Community Build is free, but you pay for hosting and maintenance.

SonarQube Cloud

Cloud Team starts at $34 per month for up to 100,000 private lines of code. Free covers up to 50,000 private lines, while Enterprise uses custom annual pricing and a wider feature set.

Plan	Starting Price	Plan Scope
Free	$0	50K LOC; post-merge PRs
Team	$34/month	100K+ LOC; PR gates
Enterprise	Custom	Unlimited option; enterprise controls
OSS	$0	Eligible public projects

Team includes secrets detection, pull request analysis, AI CodeFix, and the current Team language set. Enterprise adds organization hierarchy, SSO and SCIM, broader languages, portfolio controls, security reports, and other governance features listed on the plan page.

SonarQube Server

Sonar publishes no list price for any Server edition. Developer offers a free trial, while Enterprise and Data Center route to sales. Each edition is priced per instance, per year, by lines of code. The license covers a maximum line count for one installation.

Edition	Annual Price	Edition Scope
Community Build	$0	Core set; main branch
Developer	Quote	Branch and pull request analysis
Enterprise	Custom	Broader languages; AI CodeFix
Data Center	Custom	High availability

Server cost includes the license plus the infrastructure and staff time for upgrades, backups, monitoring, database care, and incident response. Compare that full annual figure with Cloud instead of treating self-hosting as free after the license is paid.

How Should You Roll Out SonarQube?

Roll out SonarQube on one representative repository, review the first findings and then require a narrow quality gate for new code. Assign engineering and security owners so valid findings get fixed and false positives are handled consistently.

1. Choose the deployment. Decide whether code and analysis data may leave the network before comparing features.
2. Verify the language. Check the exact analyzer, framework rules, and edition on the current support page.
3. Scan the main branch. Classify true findings, false positives, hotspots, and existing debt before enabling a gate.
4. Set the new-code baseline. Keep current pull requests strict while assigning the old backlog to a separate plan.
5. Protect one pull request. Confirm decoration, inline findings, status checks, and the exception path on a test branch.
6. Test an eligible fix. Apply an AI CodeFix only after adding a regression test for the reported issue.
7. Price the final scope. Count private lines, Server operations, Advanced Security, and commercial help in one annual figure.

Keep the first gate narrow enough that developers trust it. Expand rule coverage after the team can explain each blocked merge and resolve it without bypassing the check.

The Verdict

Choose SonarQube when static analysis needs a documented quality gate across supported languages and the organization wants either SonarQube Cloud or customer-managed Server deployment. Cloud Free and Community Build provide main-branch baselines. Pre-merge pull request analysis requires Cloud Team, Cloud Enterprise, an eligible OSS plan, or a qualifying Server edition.

Choose the edition that includes the features you need; the SonarQube name alone does not tell you what is included. Confirm language rules, branch coverage, AI CodeFix data handling, and Advanced Security entitlement against a representative repository. Choose SonarQube for first-party code and quality governance, then keep separate dependency and runtime controls where the selected plan does not cover them.

Frequently Asked Questions

Does SonarQube Cloud Free analyze pull requests?

SonarQube Cloud Free exposes pull request analysis only after the pull request has merged into main, so it cannot protect a merge with a pre-merge gate. Cloud Team and Enterprise provide pre-merge pull request analysis. The separate OSS plan provides it for eligible open-source organizations.

Does SonarQube Community Build include pull request analysis?

SonarQube Community Build focuses on automated analysis of the main branch. Its comparison table places multi-branch and pull request analysis in other deployments. Use Community Build for a self-hosted main-branch baseline, then price Server Developer when pre-merge branch analysis is required.

Which plans include SonarQube AI CodeFix?

Sonar documents AI CodeFix on Cloud Team and Enterprise. On self-hosted Server, it requires Enterprise or Data Center. The feature covers selected rules and languages, sends an affected code snippet to the chosen model service, and applies monthly usage limits when Sonar hosts the model path.

Does SonarQube include software composition analysis?

Software composition analysis comes through SonarQube Advanced Security, a separate subscription. Current Cloud documentation makes it available starting with the Team plan, while the FAQ on Sonar's pricing page ties it to Enterprise plan users. Server documentation makes it an add-on starting with Enterprise. Confirm the exact Cloud entitlement and price in writing.

Can SonarQube replace Dependabot alerts?

Core SonarQube does not replace Dependabot’s dependency advisories and security-update pull requests. SonarQube Advanced Security adds dependency analysis, but its plan requirements and update workflow differ. Keep Dependabot active until you have confirmed how every required check and update will be handled.

Where to Go Next

• Application Security hub
• Snyk guide
• Socket guide
• Dependabot guide
• Aikido vs SonarQube

Sources

• SonarQube Cloud pricing
• SonarQube Server editions
• SonarQube Cloud documentation

Updated September 24, 2026: Sonar no longer publishes a price for SonarQube Server Developer, and Sonar's Cloud documentation now places Advanced Security from the Team plan as a separate subscription.