CodeQL vs SonarQube

From $30 per active committer/month (GitHub Code Security)

From $34 per month (SonarQube Cloud Team, up to 100k lines of code)

Free on public repos. For private repositories GitHub split Advanced Security into two products in April 2025: Code Security at $30 and Secret Protection at $19 per active committer/month, both now available on Team plans as well as Enterprise. CodeQL sits in Code Security. Billing counts active committers, not seats, which can surprise teams with many occasional contributors.

SonarQube Cloud Team starts at $34/month for 100k lines of code and scales in LOC increments. Self-managed SonarQube Server (Developer, Enterprise, Data Center) is licensed per instance per year by lines of code, and SonarSource no longer publishes those figures — you have to ask sales. Branch and PR analysis requires a paid edition either way.

Free for public repositories on GitHub.

Community Build is free and self-hosted; SonarQube Cloud is free for public projects and for private projects up to 50k lines of code.

Widely used

GitHub (Microsoft) · since 2019

Category standard

Sonar · since 2007

• Interprocedural dataflow analysis finds real vulnerabilities that regex- and pattern-based tools cannot see.
• Free on public repositories, with results in the GitHub security tab.
• Custom queries let you encode organisation-specific security rules.

• Clean-as-you-code is the only quality-gate model that reliably works on legacy codebases.
• Very broad language coverage from one tool and one gate.
• Self-hosting satisfies organisations that cannot send source code externally.

• Writing custom CodeQL queries is a specialist skill with a steep learning curve.
• Analysis is slow — minutes to tens of minutes, so it fits nightly better than per-commit.
• Private-repo licensing through Advanced Security is expensive at scale.

• Branch and pull-request analysis — the feature most teams actually need — is paid only.
• Default rule sets are noisy until tuned to the team.
• Self-hosted instances need real resources and maintenance.

GitHub-hosted projects wanting deep static security analysis, free if the repo is public.

Polyglot organisations that need one quality gate across every repository.