Index › Developer platform › SAST › SonarQube vs GitHub Advanced Security

Static application security testing · October 2026 Edition

SonarQube vs GitHub Advanced Security

Three of fourteen models named SonarQube first on the direct prompt; zero named GitHub Advanced Security. SonarQube was named by fourteen of the fourteen models and GitHub Advanced Security by eleven and SonarQube carries 62 labels and GitHub Advanced Security 16, so the shares are not directly comparable.

SonarQube

accepted challenger

Named in four categories this edition.

GitHub Advanced Security

accepted challenger

Named in five categories this edition.

First-choice share22%2%Of first choices across the direct, paraphrase, budget and scale prompts, 0 to 100.

Negative rate18%6%Negative labels as a share of the product's labels, 0 to 100.

Rank in category#2#6A position in a field of 10; printed, not drawn.

Labels6216A count; the two differ.

The two percentage rows are drawn on one 0 to 100 track, SonarQube reading right to left. Rank and label count are printed, not drawn.Semgrep was named alongside these two in twelve of the fourteen direct answers. Semgrep vs SonarQube · Semgrep vs GitHub Advanced Security · SonarQube vs Snyk Code

Share is the count of first choices across the direct, paraphrase, budget and scale prompts over all fourteen models, for a mid-market B2B company; rank is within the category; every quote names the model and the prompt it came from. Both figures come from the static application security testing page.

By framing

How many of the fourteen models made each the first choice, per way of asking, and how many argued against it.

SonarQubeFirst choices, of fourteen modelsGitHub Advanced Security

Direct30

Paraphrase511 against GitHub Advanced Security

Comparative003 against SonarQube

Budget-constrained30

Scale-constrained00

Negative008 against SonarQube

Bars are first choices, 0 to 14 each sideModels that argued againstA model can name both, so the two sides of a row do not sum to fourteen.

Across every category in the October 2026 Edition, SonarQube and GitHub Advanced Security were named in the same answer forty-four times, of the 189 answers naming SonarQube and the 125 naming GitHub Advanced Security. In those answers GitHub Advanced Security took the first choice two times and SonarQube seven.

Every model, every framing

The eighty-four answers behind the chart above, one cell each: where SonarQube and GitHub Advanced Security stood in it.

Model	DirectSO	ParaphraseSO	ComparativeSO	Budget-constrainedSO	Scale-constrainedSO	NegativeSO
Claude Haiku 4.5		SO		SO		SO
GPT-5.4 mini		SO	SO	SO
Gemini 3.5 Flash		SO	SO	SO
Perplexity Sonar		SO		SO
Grok 4.1 Fast	SO	SO	SO	SO	SO	SO
Mistral Small		SO		SO		SO
DeepSeek V4 Flash	SO	SO	SO	SO		SO
Llama 4 Maverick				SO
Qwen 3.7 Flash	SO	SO	SO	SO		SO
Kimi K2	SO	SO	SO	SO		SO
GLM 4.7 FlashX	SO	SO		SO
MiniMax M2.5		SO	SO	SO		SO
GPT-6 Luna			SO	SO		SO
Muse Glimmer 30B	SO	SO	SO	SO		SO

SO SonarQube

GitHub Advanced SecuritySO first choiceSO named as an alternativeSO argued againstblank: not namedEach cell is one answer, SonarQube on the left and GitHub Advanced Security on the right.

The direct prompt

The plain question, one answer per model, grouped by where SonarQube and GitHub Advanced Security stood in it.

SonarQube first, GitHub Advanced Security an alternative

3 of 14 modelsGitHub Advanced Security was named in the answer but not as the choice, or not at all.

Qwen 3.7 FlashSonarQube alternatives: Semgrep, Snyk Code

GLM 4.7 FlashXSonarQube alternatives: Checkmarx One, Codacy, DeepSource, GitHub Advanced Security, OpenText Fortify, Semgrep, Snyk Code, Veracode Static Analysis

Muse Glimmer 30BSonarQube alternatives: Semgrep

Neither was the first choice, one was named

5 of 14 modelsThe answer put something else first and named one of the two as an alternative.

Gemini 3.5 FlashAikido Security alternatives: GitHub Advanced Security, GitLab SAST, Semgrep, Snyk Code

Grok 4.1 FastSnyk Code alternatives: Semgrep, SonarQube

DeepSeek V4 FlashSnyk Code alternatives: CodeAnt.ai, Semgrep, SonarQube

Kimi K2Semgrep, Snyk Code alternatives: SonarQube

GPT-6 LunaSemgrep alternatives: GitHub Advanced Security, Snyk

Neither was named

6 of 14 modelsThe answer made no first choice from these two in this category.

Claude Haiku 4.5no first choice

GPT-5.4 miniSemgrep alternatives: Checkmarx One, Snyk Code, Veracode Static Analysis

Perplexity SonarSemgrep alternatives: Checkmarx One, Snyk Code

Mistral SmallSnyk alternatives: Aikido Security, Semgrep

Llama 4 MaverickSnyk Code

MiniMax M2.5Snyk alternatives: Semgrep, Veracode Static Analysis

Bold names in an answer are the products the judge labeled a first choice; a model naming several gives each of them that label. The full answer text for every row is in the record.

By buyer segment

The same question asked on behalf of a different buyer. Each standing is computed within its segment and they are never added together. The figures above are the mid-market standing, which is the one the category orders by.

Small business

SonarQube leads by twelve points.

SonarQube#2 of 13

GitHub Advanced Security#6 of 13

The full small business standing →

Mid-marketThe figures above

SonarQube leads by twenty points.

SonarQube#2 of 10

GitHub Advanced Security#6 of 10

The full mid-market standing →

Enterprise

SonarQube leads by seven points.

SonarQube#3 of 10

GitHub Advanced Security#8 of 10

The full enterprise standing →

What the models said about SonarQube

Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Six of eight in this category shown.

“Noisiest out-of-box (40-60%+ FPs on Java/TS; OWASP F1-score ~27% in some evals)... avoid for security-only if you can't invest in config” Grok 4.1 Fast · negative prompt · hard negative

“Tools originally designed for *general code quality* (like SpotBugs, SonarQube's default rules) are often very weak at security-specific detection” DeepSeek V4 Flash · negative prompt · soft negative

“A code-quality scanner treated as comprehensive security coverage... verify the actual security rules for your languages, frameworks, and edition.” GPT-6 Luna · negative prompt · soft negative

“The best SAST tool for a company with a limited budget is Semgrep's free tier, SonarQube Community, Snyk Code's Team plan, or DeepSource.” Llama 4 Maverick · budget prompt · first choice

“The Best All-Around Choice: SonarQube (by SonarSource) This is the most balanced recommendation for most mid-sized companies.” Qwen 3.7 Flash · paraphrase prompt · first choice

“For many mid-sized B2B companies, SonarQube or Snyk offer good balance between cost, ease of use, and effectiveness.” Claude Haiku 4.5 · paraphrase prompt · first choice

What the models said about GitHub Advanced Security

Every negative label with a quote, up to three, then the highest-weighted positives, up to three. Three of three in this category shown.

“GHAS is sold as an add-on license that can be quite expensive for a mid-sized B2B budget.” Gemini 3.5 Flash · paraphrase prompt · soft negative

“Top Recommendation: GitHub Advanced Security (GHAS)” Kimi K2 · paraphrase prompt · first choice

“GitHub Advanced Security / CodeQL if your company is deeply GitHub-native and wants SAST in the same platform.” Muse Glimmer 30B · comparative prompt · alternative

Also compared

Semgrep vs SonarQube Semgrep vs GitHub Advanced Security SonarQube vs Snyk Code SonarQube vs Snyk SonarQube vs CodeQL SonarQube vs Veracode Static Analysis SonarQube vs Checkmarx One Snyk Code vs GitHub Advanced Security Snyk vs GitHub Advanced Security CodeQL vs GitHub Advanced Security GitHub Advanced Security vs Veracode Static Analysis GitHub Advanced Security vs Checkmarx One All twenty-eight head-to-head pages and the full SAST standing

Comparisons are drawn for the top eight products in each category, each against each. The output is the models' output; nothing here is a recommendation by the index.