SonarQube
Ranked 5 of 12 static analyzers by recommenders
Recommended for cheap, token-free code checks and long-term coverage tracking; critics say its findings are noisy, shallow, and often miss real problems.
Recommended for cheap, token-free code checks and long-term coverage tracking; critics say its findings are noisy, shallow, and often miss real problems.
23 people gave an opinion
- recommend it
- 10
- criticize it
- 13
- approval share
- 43%
Recommended in 6 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: not recommended
- May 2026: not recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 10 people recommend itNeeds 10 or more, met.
- 0.7 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 6 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Cheap automated review without AI tokens
“You can even put them on the build pipeline, even. No tokens spent at all!”
Comment from 10 Jul 2026 in “Write code like a human will maintain it” “Mechanical code review by something like sonar qube is much cheaper.”
Comment from 5 Sep 2026 in “GPT-6 Astra in code review: Gains, privacy, and cost”
What people warn about
Each mark is one comment
Mostly noise with many false positives
“it found something like seven issues, out of which only one or two were actual bugs. It was almost entirely useless.”
Comment from 2 Jul 2026 in “No LLM Code in Dependencies” “Most of the feedback is just sh*t and drives programmers towards making senseless perfections”
Comment from 27 Jan 2026 in “There Is an AI Code Review Bubble” “the false positive rate is anywhere from 20% to 80% for a lot of our sniff tests”
Comment from 16 Sep 2026 in “ImpactGate: A merge gate that scores the structural decay AI adds” - Comment from 13 Jan 2026 in “Junior devs don't know the red flags we spot in seconds and we never tell them”
- Comment from 3 Jul 2026 in “No LLM Code in Dependencies”
Encourages gaming the quality gate
“I guarantee you will pass the gate, and the code will still be dumb, except now you'll spend 10x the tokens.”
Comment from 22 Sep 2026 in “AI Has No Wisdom and Neither Will You” “Most of the feedback is just sh*t and drives programmers towards making senseless perfections”
Comment from 27 Jan 2026 in “There Is an AI Code Review Bubble” “bloated, Goodhart's law inviting, waste of time”
Comment from 19 Apr 2026 in “Notion leaks email addresses of all editors of any public page” Misses real security and style issues
“did not flag public fields as a security issue by default the last time I used it”
Comment from 22 Mar 2026 in “Delve – Fake Compliance as a Service” “ESLint/SonarQube don't even look for these”
Comment from 12 Mar 2026 in “Show HN: Open Code Review – Free CI/CD quality gate for AI-generated code” Shallow, low-effort analysis output
“The analyses in general are low quality and you can see not a lot of effort or thought went into them.”
Comment from 22 Mar 2026 in “Delve – Fake Compliance as a Service” “the 'analysis' it produces is incredibly shoddy”
Comment from 21 Mar 2026 in “Delve – Fake Compliance as a Service”
Other static analyzers people recommend
The four most recommended other static analyzers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| zizmor | 19 | 1 | 95% | 6 | — | Approved |
| Semgrep | 14 | 10 | 58% | 7 | — | — |
| clang-tidy | 14 | 4 | 78% | 6 | — | Approved |
| PHPStan | 11 | 0 | 100% | 7 | — | Approved |
| SonarQubeThis page | 10 | 13 | 43% | 6 | — | — |
What people said
23 of the 26 comments that mention it, newest first. Each links to the original comment.
“Why isn't there a "shallowbot", or some CI configuration that tries to fix CI mistakes once before humans dive in?”
“It led to more regular coding practices that ultimately made the codebase easier to read and understand.”
“it's a little galling to see which ones SQ gave a lower score”
“I guarantee you will pass the gate, and the code will still be dumb, except now you'll spend 10x the tokens.”
“Sonar's cognitive complexity metric is a bit better, but here's a study that found that it still only has about a 0.5 correlation”
“the false positive rate is anywhere from 20% to 80% for a lot of our sniff tests”
“Mechanical code review by something like sonar qube is much cheaper.”
“These are well known industry standards for knowing a code change is correct”
“You can even put them on the build pipeline, even. No tokens spent at all!”
“It was almost entirely useless.”
“it found something like seven issues, out of which only one or two were actual bugs. It was almost entirely useless.”
“bloated, Goodhart's law inviting, waste of time”
“The analyses in general are low quality and you can see not a lot of effort or thought went into them.”
“did not flag public fields as a security issue by default the last time I used it”
“the 'analysis' it produces is incredibly shoddy”
“SonarQube was great for long-term tracking of coverage stats.”
“ESLint/SonarQube don't even look for these”
“SonarQube is pretty useless for quality control unless your process is already broken”
“this looks very enterprisey”
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube on large monorepos”
“Most of the feedback is just sh*t and drives programmers towards making senseless perfections”
“these tools do not understand that living and evolving code needs imperfections”
“It was total shit busy work they stuck me with”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.