SonarQube

by Sonar (SonarSource)

Code quality and security platform that finds bugs, vulnerabilities and security hotspots on every pull request.

Visit website

Application & API Security

Starting priceFree up to 50k LOC; Team from $34/month

Pricing modelfreemium

DeploymentCloud (SonarQube Cloud); self-managed (SonarQube Server)

Free trialYes

About

Code quality and security platform that finds bugs, vulnerabilities and security hotspots on every pull request.

SonarQube combines code quality, security and AI code review on one platform. It finds bugs, vulnerabilities and security hotspots across 30+ languages on every pull request, with 45+ languages on the Enterprise plan.

SonarQube Advanced Security adds advanced SAST and software composition analysis, covering CVEs, malicious packages, SBOM and license policy. It is available as SonarQube Cloud or as self-managed SonarQube Server in Developer, Enterprise and Data Center editions, priced per instance per year by lines of code. A free tier covers private projects up to 50k LOC and public OSI-licensed repos, and the Team plan has a 14-day trial.

Key features

Bugs, vulnerabilities and security hotspot detection; Advanced SAST and SCA; Malicious package, SBOM and license policy checks; AI code review; Pull request analysis; SonarQube MCP Server; Free SonarQube for IDE extension; OWASP and MISRA reporting on Enterprise

Product details

Vendor

Sonar (SonarSource)

Pricing

Free up to 50k LOC; Team from $34/monthFree trial available

Pricing model: freemium

Plans

Free: private projects up to 50k LOC, public OSI-licensed repos free; Team: from $34/month for up to 100k LOC, 14-day trial; Enterprise: custom pricing

Visit website for full pricing details

Similar software

42Crunch

by 42Crunch

API security platform that applies contract driven security assessment, vulnerability testing and runtime protection to APIs and to the MCP servers used by AI agents.

Contact for pricing

Aikido Security

by Aikido Security

Developer-focused AppSec suite covering code, cloud and runtime with SAST, SCA, DAST and secrets detection.

Free; Basic $350/month

Akamai API Security

by Akamai Technologies

API security product from Akamai that gives visibility into an organization's full API estate with continuous detection and analysis, from development through production.

Contact for pricing

Barracuda WAF-as-a-Service

by Barracuda Networks

Cloud-delivered WAF with API protection, bot defense and unmetered L3-L7 DDoS protection.

Contact for pricing

Black Duck Polaris

by Black Duck

Cloud-native AppSec platform unifying SAST, SCA, DAST, IaC analysis and secrets detection.

Consumption-based pricing

Burp Suite Professional

by PortSwigger

Web security testing toolkit for penetration testers, with a proxy, scanner, Intruder and an extension store.

Professional $499