We performed a comparison between Coverity and SonarQube based on our users’ reviews in four categories. After reading all of the collected data, you can find our conclusion below.
Comparison Result: Based on the parameters we compared, SonarQube comes out ahead of Coverity. Although both products have valuable features and can be estimated as high-end solutions, our reviewers found that Coverity is an expensive solution with an unfriendly licensing mechanism and a difficult exit process, which may make it less accessible for smaller teams or companies with budgetary constraints.
"The security analysis features are the most valuable features of this solution."
"The most valuable feature is that there were not a whole lot of false positives, at least on the codebases that I looked at."
"The most valuable feature of Coverity is the wrapper. We use the wrapper to build the C++ component, then we use the other code analysis to analyze the code to the build object, and then send back the result to the SonarQube server. Additionally, it is a powerful capabilities solution."
"Coverity gives advisory and deviation features, which are some of the parts I liked."
"It provides reports about a lot of potential defects."
"The most valuable feature of Coverity is that it shows examples of what is actually wrong with the code."
"The interface of Coverity is quite good, and it is also easy to use."
"Coverity is scalable."
"We can create a Quality Gate in order to fail Jenkins jobs where the code coverage is lower than the set percentage."
"It provides you with many features, as it does with the premium model, but there are still extra features that can be purchased if needed."
"We consider it a handy tool that helps to resolve our issues immediately."
"It helps our developers work more efficiently as we can identify things in a code prior to it being pushed to where it needs to go."
"It is very good at identifying technical debt."
"The depth features I have found most valuable. You receive a quick comprehensive comparison overview regarding the current release and the last release and what type of depths dependency or duplication should be used. This is going to help you to make a more readable code and have more flexibility for the engineers to understand how things should work when they do not know."
"The most valuable feature is the security hotspot feature that identifies where your code is prone to have security issues."
"I like that it has a better dashboard compared to Clockwork. It's also stable."
"The quality of the code needs improvement."
"There should be additional IDE support."
"It would be great if we could customize the rules to focus on critical issues."
"It should be easier to specify your own validation routines and sanitation routines."
"Ideally, it would have a user-based license that does not have a restriction in the number of lines of code."
"The solution's user interface and quality gate could be improved."
"SCM integration is very poor in Coverity."
"Coverity takes a lot of time to dereference null pointers."
"A robust credential scanner would be a huge bonus as it would remove the need for yet another niche product."
"The pricing could be reduced a bit. It's a little expensive."
"The interface could be a little better and should be enhanced."
"Dynamic scanning is missing and there are some issues with security scanning."
"A little bit more emphasis on security and a bit more security scanning features would be nice."
"I find it is light on the security side."
"If there was an official Docker image of SonarQube that could easily integrate into the pipeline would help the user to plug in and plug out and use it directly without any custom configuration. I am not sure if this is being offered already in an update but it would be very helpful."
"We're in the process of figuring out how to automate the workflow for QA audit controls on it. I think that's perhaps an area that we could use some buffing. We're a Kubernetes shop, so there are some things that aren't direct fits, which we're struggling with on the component Docker side. But nothing major."
Coverity is ranked 4th in Application Security Testing (AST) with 33 reviews while SonarQube is ranked 1st in Application Security Testing (AST) with 110 reviews. Coverity is rated 7.8, while SonarQube is rated 8.0. The top reviewer of Coverity writes "Best SAST tool to check software quality issues". On the other hand, the top reviewer of SonarQube writes "Easy to integrate and has a plug-in that supports both C and C++ languages". Coverity is most compared with Klocwork, Fortify on Demand, Checkmarx One, Veracode and Polyspace Code Prover, whereas SonarQube is most compared with Checkmarx One, SonarCloud, Veracode, Snyk and GitHub Advanced Security. See our Coverity vs. SonarQube report.
See our list of best Application Security Testing (AST) vendors.
We monitor all Application Security Testing (AST) reviews to prevent fraudulent reviews and keep review quality high. We do not post reviews by company employees or direct competitors. We validate each review for authenticity via cross-reference with LinkedIn, and personal follow-up with the reviewer when necessary.
