SonarQube (SonarSource)

SonarQube from SonarSource analyses code for quality and security issues, priced by lines of code rather than by user, with a Team tier from thirty four dollars and a Core tier at twenty dollars per user for up to fifty users covering unlimited public and private repositories.

Pricing by lines of code is unusual and reflects what the product actually processes. A team of five maintaining two million lines is doing more analysis than a team of fifty on a small service, and a per seat price would charge those two backwards relative to the work performed.

The distinctive concept SonarQube introduced is the quality gate applied to new code rather than to the whole codebase. Demanding that a large legacy application reach a quality standard is hopeless and everybody ignores it, whereas requiring that newly written code meets the standard is achievable immediately and improves the codebase steadily as it is touched.

That framing is the reason the product succeeded where earlier static analysis largely failed. Tools that reported forty thousand issues on first run were switched off within a fortnight, because the number was too large to act on and too demoralising to look at, while a gate on new code produces a handful of findings a developer can fix now.

Coverage spans quality and security together, which suits organisations that do not have a separate application security function and want one tool their developers already run.