SonarQube
SonarQube is the most widely used platform for static code analysis — it scans your codebase for bugs, vulnerabilities, code smells, and coverage gaps without executing the code. Getting it running takes about 30 minutes: start the server (Docker is easiest), configure a project, run the scanner, and read the results
SonarQube
SonarQube ships with thousands of rules, but your team likely has conventions the built-in rules don't cover. Custom rules let you enforce team-specific patterns — banned methods, required annotations, naming conventions — using the SonarQube plugin API or simpler XPath/template rules. Key Takeaways Three ways to add
SonarCloud
SonarCloud is the hosted version of SonarQube. You connect your GitHub/GitLab/Bitbucket account, import your repositories, and SonarCloud analyzes every push and PR — no server to run, no database to manage. Free for public repositories; paid for private. The tradeoff versus self-hosted: no admin control over rules or
Security Testing
Static application security testing (SAST) finds vulnerabilities before your code ships. Coverity, from Synopsys, is one of the most widely deployed SAST tools in enterprise environments — used by teams that need low false-positive rates and deep language support. This guide covers what Coverity does, how to set it up,
Security Testing
Checkmarx is one of the most widely deployed SAST platforms globally, known for its extensive language support, customizable queries, and strong developer workflow integrations. If your organization has a formal AppSec program, Checkmarx SAST (now part of Checkmarx One) is likely on the shortlist. This guide covers how Checkmarx works,
Semgrep
Semgrep is a fast, syntax-aware static analysis tool that lets you write custom security rules in YAML using code patterns rather than regular expressions. This guide covers rule syntax, writing custom rules for your codebase, using community rulesets, CI integration, and reducing false positives through triage and rule refinement.