# SonarQube: how AI models rank it, November 2026

Gane Index, November 2026 Edition. Named in 73 judge labels across 3 categories by 14 of 14 models. Page: https://www.gane.ai/index/it/vendors/sonarqube

## Standing by category

| Category | Share | Rank | Negative rate | Labels |
|---|---|---|---|---|
| [Static application security testing](https://www.gane.ai/index/it/developer/static-application-security-testing/index.md) | 11% | 2 | 16% | 67 |
| [Application security posture management](https://www.gane.ai/index/it/developer/application-security-posture-management/index.md) | 0% | 33 | 25% | 4 |
| [Software composition analysis](https://www.gane.ai/index/it/developer/software-composition-analysis/index.md) | 0% | 39 | 0% | 2 |

## What the models said for it

- "The most widely used, adopted by 59% of developers. It's known for its ease of use, integration with CI/CD pipelines, and broad language support." (Mistral Small, SAST)
- "I'd recommend starting with SonarQube or Snyk Code due to their balance of features, pricing, and ease of use" (GLM 4.7 FlashX, SAST)
- "I would recommend SonarQube (commercial or self‑hosted) as your primary static code security scanner" (GLM 4.7 FlashX, SAST)
- "SonarQube and CodeQL are the most widely adopted today, especially for web/backend teams." (GLM 4.7 FlashX, SAST)

## And against it

- "Not a true SAST tool... Inadequate for compliance (PCI-DSS, SOC 2)" (Kimi K2, SAST)
- "SonarQube is primarily a code quality platform, not a security-first SAST tool... "should not be used as a sole SAST tool in security-sensitive environments."" (DeepSeek V4 Flash, SAST)
- "On a typical Java or TypeScript codebase, 40-60% of initial findings require developer review to determine whether they represent actual risk" (Claude Haiku 4.5, SAST)
- "SonarQube editions chosen on "security" branding alone: Check which security rules, languages, and taint-analysis capabilities are included" (GPT-6 Luna, SAST)

## By model

| Model | First choice | Alternative | Mention | Warning | Labels |
|---|---|---|---|---|---|
| Claude Haiku 4.5 | 1 | 2 | 0 | 2 | 5 |
| GPT-5.4 mini | 0 | 2 | 0 | 0 | 2 |
| Gemini 3.5 Flash | 0 | 4 | 1 | 1 | 6 |
| Perplexity Sonar | 0 | 4 | 0 | 0 | 4 |
| Grok 4.20 | 1 | 2 | 1 | 2 | 6 |
| Mistral Small | 1 | 3 | 1 | 0 | 5 |
| DeepSeek V4 Flash | 0 | 4 | 0 | 2 | 6 |
| Llama 4 Maverick | 0 | 2 | 1 | 0 | 3 |
| Qwen 3.7 Flash | 1 | 7 | 1 | 1 | 10 |
| Kimi K2 | 0 | 3 | 3 | 2 | 8 |
| GLM 4.7 FlashX | 3 | 1 | 0 | 0 | 4 |
| MiniMax M2.5 | 0 | 4 | 1 | 0 | 5 |
| GPT-6 Luna | 0 | 3 | 0 | 1 | 4 |
| Muse Glimmer 30B | 0 | 3 | 1 | 1 | 5 |

## Sources returned with these answers

The sites and pages cited by the answers that named SonarQube, from 178 of the 219 answers that named it (only the models that return a source list).

### Domains cited

- safeguard.sh: 81
- checkmarx.com: 74
- appsecsanta.com: 70
- dev.to: 63
- aikido.dev: 40
- g2.com: 40
- gane.ai/index: 40
- deepsource.com: 34
- securityboulevard.com: 34
- corgea.com: 32

### Pages cited

- https://checkmarx.com/learn/sast/open-source-vs-premium-sast-tools: 48
- https://dev.to/rahulxsingh/i-reviewed-32-sast-tools-the-ones-worth-using-283e: 43
- https://appsecsanta.com/sast-tools: 41
- https://appsecsanta.com/sast-tools/enterprise-sast-tools: 32
- https://deepsource.com/resources/static-analysis-tools: 32
- https://startupstash.com/best-sast-tools: 29
- https://fluidattacks.com/blog/top-10-sast-tools: 25
- https://securityboulevard.com/2025/06/best-sast-tools-top-10-solutions-compared: 25

## Record

- Method: https://www.gane.ai/index/it/methodology
- License: CC BY 4.0. Cite as Gane Index, November 2026 Edition, www.gane.ai/index/it.