# SonarQube

10 Hacker News commenters recommended SonarQube and 13 criticized it, November 2025 to November 2026. It was recommended in 6 of 13 months.

**Verdict:** Recommended for cheap, token-free code checks and long-term coverage tracking; critics say its findings are noisy, shallow, and often miss real problems.

## Why people recommend it

- Cheap automated review without AI tokens (2 comments): "You can even put them on the build pipeline, even. No tokens spent at all!" ([source](https://news.ycombinator.com/item?id=48863755)) "Mechanical code review by something like sonar qube is much cheaper." ([source](https://news.ycombinator.com/item?id=49576885))

## What people warn about

- Mostly noise with many false positives (5 comments): "it found something like seven issues, out of which only one or two were actual bugs. It was almost entirely useless." ([source](https://news.ycombinator.com/item?id=48767906)) "Most of the feedback is just sh*t and drives programmers towards making senseless perfections" ([source](https://news.ycombinator.com/item?id=46776366)) "the false positive rate is anywhere from 20% to 80% for a lot of our sniff tests" ([source](https://news.ycombinator.com/item?id=49727585))
- Encourages gaming the quality gate (3 comments): "I guarantee you will pass the gate, and the code will still be dumb, except now you'll spend 10x the tokens." ([source](https://news.ycombinator.com/item?id=49801184)) "Most of the feedback is just sh*t and drives programmers towards making senseless perfections" ([source](https://news.ycombinator.com/item?id=46776366)) "bloated, Goodhart's law inviting, waste of time" ([source](https://news.ycombinator.com/item?id=47825687))
- Misses real security and style issues (2 comments): "did not flag public fields as a security issue by default the last time I used it" ([source](https://news.ycombinator.com/item?id=47475519)) "ESLint/SonarQube don't even look for these" ([source](https://news.ycombinator.com/item?id=47351372))
- Shallow, low-effort analysis output (2 comments): "The analyses in general are low quality and you can see not a lot of effort or thought went into them." ([source](https://news.ycombinator.com/item?id=47476075)) "the 'analysis' it produces is incredibly shoddy" ([source](https://news.ycombinator.com/item?id=47466432))

## Alternatives hackers recommend

- [zizmor](https://hackerapproved.com/p/zizmor.md): 19 recommend
- [Semgrep](https://hackerapproved.com/p/semgrep.md): 14 recommend
- [clang-tidy](https://hackerapproved.com/p/clang-tidy.md): 14 recommend
- [PHPStan](https://hackerapproved.com/p/phpstan.md): 11 recommend
- [CodeQL](https://hackerapproved.com/p/codeql.md): 9 recommend

## Where to get it

- [Visit the official site](https://www.sonarsource.com/products/sonarqube/)

## Cite as

Hacker Approved, "SonarQube", https://hackerapproved.com/p/sonarqube/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).