Semgrep vs SonarQube
Four of twelve models named Semgrep first on the direct prompt; two named SonarQube. Both were named by all twelve models and Semgrep carries 56 labels and SonarQube 48, so the shares are not directly comparable.
Named in three categories this edition.
Named in two categories this edition.
Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all twelve models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the static application security testing page.
By framing
SemgrepFirst choices, of twelve modelsSonarQube
The direct prompt
Semgrep first, SonarQube an alternative
4 of 12 modelsSonarQube was named in the answer but not as the choice, or not at all.SonarQube first, Semgrep an alternative
2 of 12 modelsSemgrep was named in the answer but not as the choice, or not at all.Neither was the first choice, one was named
4 of 12 modelsThe answer put something else first and named one of the two as an alternative.Neither was named
2 of 12 modelsThe answer made no first choice from these two in this category.Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.
By buyer segment
Semgrep70%#1 of 12SonarQube2%#5 of 12Semgrep47%#1 of 11SonarQube22%#2 of 11SonarQube10%#3 of 9Semgrep2%#5 of 9What the models said about Semgrep
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Three of four in this category shown.
“For Developer-First Speed & Flexibility: Semgrep Code or Snyk Code. They are incredibly fast, have great PR integration, and are built around developer workflows.” Gemini 3.5 Flash · scale prompt · first choice
“The best SAST tool for a company with a limited budget is Semgrep CE, which is a free SAST scanner that supports 30+ languages” Llama 4 Maverick · budget prompt · first choice
“I recommend Semgrep (specifically the Semgrep AppSec Platform) as your primary static code security scanner.” GLM 4.7 FlashX · paraphrase prompt · first choice
What the models said about SonarQube
Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of seven in this category shown.
“SonarQube: High false positive rates out-of-the-box (40-82% ...) ... Tune heavily or pair with security-specific tools.” Grok 4.1 Fast · negative prompt · soft negative
“SonarQube on default settings flags 40‑60 % of findings as non‑issues on typical Java or TypeScript codebases” GLM 4.7 FlashX · negative prompt · soft negative
“Mature platform, 40+ languages, strong for governance — but noisier out of the box and requires tuning.” DeepSeek V4 Flash · paraphrase prompt · soft negative
“Choose SonarQube if you treat security as a subset of quality, need to reduce technical debt, and want better control over costs at scale.” Qwen 3.7 Flash · direct prompt · first choice
“Widely used, supports multiple languages, integrates well with CI/CD... making it a solid choice for mid-sized teams” Mistral Small · paraphrase prompt · first choice
“SonarQube or Snyk Code would be the best starting points. SonarQube offers the best overall value” MiniMax M2.5 · direct prompt · first choice
Comparisons are drawn for the top three products in each category. The output is the models' output; nothing here is a recommendation by the index.