SonarQube keeps the code clean. WASViking keeps the application safe.
SonarQube earned its place in thousands of pipelines by making code more maintainable, and it checks security along the way. WASViking Code Security is built for security alone: it reads the code where access is decided, explains how each weakness can be exploited, fixes it for the exact line, and puts it in the same queue as the testing of the running application.
141 def set_role(user_id: int, body: RoleIn, user=Depends(current_user)):
142 return users.update(user_id, role=body.role)
- Any signed-in user can promote any account to admin
- Attack: PUT /api/users/7/role with role=admin from a viewer session
- Fix: require_admin(user) before the update
Where the difference shows up in daily work.
A quality tool asks whether the code is well written. A security tool asks whether someone can abuse it. Both questions matter, and they lead to different findings.
Only what an attacker can use
No code smells, duplication or style issues in the queue. Every finding is a security weakness, so the security team and the developers argue about fixes, not about whether a finding matters.
Where access is decided
Broken access control is the top category of the OWASP Top 10 and hard for rule-based analysis to see. The review goes to routes, controllers, handlers and authorization code, and names the route and parameter.
A verdict, not a review task
Instead of a hotspot for someone to review by hand, each finding says why it is exploitable, gives an attack scenario and brings the fix, with the line checked against the real file first.
A price that does not grow with every line
Each monitored repository counts as one unit, whatever its size and however often it is scanned. A monorepo that doubles in size does not double the bill.
A rule that matched, or a weakness that someone can exploit.
Rule-based analysis is fast and consistent, and it reports what matched a rule. Code Security reports what an attacker could do, and what to change so they cannot.
Rule-based quality and security analysis
What a finding typically carries
WASViking® Code Security
What every finding carries
The largest group is the hardest for rule-based tools to see.
In ACME's repositories, access control flaws were the largest group of weaknesses in the code the team wrote itself. Vulnerable dependencies and secrets came with the same scan.
ACME open code findings, by class
55 findings across 38 monitored repositories
Highlighted: access control, 25 findings together, the largest group in the code ACME wrote itself.
Findings with a stable identity
The same weakness in the same place stays one finding as line numbers move. It reopens on regression and resolves once two consecutive reviews of the file no longer find it.
Coverage that widens on its own
Files with an open finding are reviewed again on every scan, and the rest of the review budget rotates across the repository, so each run looks somewhere new.
Twelve weeks of high-severity code findings going down.
Security leads do not need a maintainability grade. They need to know whether the weaknesses that matter are closing, and how fast.
ACME open high and critical code findings
Weekly, security findings only. Lower is better.
Closed in the tracker, closed here
Jira and ServiceNow stay in sync both ways. A verified fix closes the card with a note, and a regression reopens it.
One report for the code owner
The repository PDF lists every open finding by engine, in a format a code owner or an auditor can read without a console account.
Illustrative data from the ACME demonstration tenant
Every monitored repository, its findings and its last run.
Monitored repositories, open findings by engine and the SAST findings of each repository on one page, next to the rest of the platform.
Capability by capability, what each product delivers.
The SonarQube column covers SonarQube Server and SonarQube Cloud, with the edition noted where a capability depends on it. Where both products do the job well, we say so.
| Capability | SonarQube | WASViking® Code Security |
|---|---|---|
| Getting code scanned | ||
| Where the analysis runs | A scanner in the CI pipeline, self-hosted with SonarQube Server or in SonarQube Cloud | On the platform side, from a GitHub or Bitbucket connection, on the plan cadence and on pushes to the default branch. Nothing to host On par |
| Pipeline gate | Quality gates and pull request decoration | Sentinel CI gate in GitHub Actions and Bitbucket Pipelines that fails on new findings, merged into the same repository history On par |
| Finding quality | ||
| Injection flaws | Taint analysis in code, from the Developer Edition up | Tested on the running application by DAST: SQL injection, command injection, SSTI and XXE, each with the request and response that prove it On par |
| Access control | Security rules and hotspots for sensitive code | Review of routes, controllers, handlers and authorization code for IDOR, broken object and function level authorization, missing authorization checks and clickjacking Goes further |
| What a finding tells you | Rule, location and, for hotspots, a manual review step | Line verified against the real file, why it is exploitable and an attack scenario, with no review step before it counts Goes further |
| Remediation guidance | AI CodeFix suggestions | The fix for the exact code on every finding, included in Code Security On par |
| Around the code | ||
| Open source dependencies | Software composition analysis in SonarQube Advanced Security, an extension | Dependency analysis against OSV and CISA KEV with drift since the previous scan, included on every run with a CycloneDX SBOM Goes further |
| Secrets | Secrets detection rules | Working tree on every run, full history of the default branch when you switch it on, evidence redacted before storage On par |
| The running application | Code analysis | Code findings in the same queue as external and internal DAST, API testing and edge telemetry of the same application, with one risk score and one SLA Goes further |
| CommercialLicensing | ||
| What drives the price | Lines of code analyzed | Monitored repositories: each one counts as one unit, whatever its size and however often it is scanned Goes further |
What the same platform does with the same application.
Code is one view of an application. WASViking also tests it while it runs, watches its dependencies after release and records the evidence your customers ask for.
External and internal DAST
Authenticated testing of the running web application and its APIs, internal ones included through the Sentinel agent, without VPN or inbound ports.
Supply chain after release
The SBOM of each repository is checked every day against new advisories, so a vulnerability published next month reaches the right team without a new scan.
Evidence for auditors and customers
Findings mapped to PCI DSS 6.2.3 and 6.3.2, ISO 27001, NIST SSDF and LGPD, with Evidence Bundles and Posture Shares an auditor or customer can open.
Point both at the same repositories and compare.
The evaluation runs on your own code, so the decision rests on your own findings and not on a benchmark.
Connect the organization
Install the GitHub App or approve the Bitbucket consumer. Nothing changes in your pipelines.
Pick the repositories
Start with the services that handle customer data and authorization, where security findings matter most.
Compare the security findings
Filter the other tool down to security issues and put the two lists side by side. Look at the authorization code in particular.
Connect the tracker
Turn on Jira or ServiceNow for one team and follow a finding from card to verified fix.
Frequently asked questions
Should we replace SonarQube or run both?
If your team uses SonarQube mainly for code quality, keep it for that and move security to Code Security, where findings come with an attack scenario and share a queue with the rest of your application security. If you bought it for security, Code Security covers that job on its own.
Does it replace our pull request quality gate?
For security, yes: the Sentinel CI step fails a build on new security findings in GitHub Actions and Bitbucket Pipelines. Quality gates on coverage, duplication or style stay with your quality tool.
Does our code leave our control?
Each run clones the default branch into an isolated, short-lived workspace on a dedicated worker. Nothing from the repository is executed, and the clone is deleted at the end of the run. Only findings, the component list, redacted evidence and the run record are kept.
How are false positives kept down?
Every reported line is checked against the real file before it reaches you, and a weakness that cannot be grounded in the code is discarded. A finding also resolves on its own when two consecutive reviews of the file no longer see it.
How is it licensed?
Code Security is included on the Pro plan and above. Each monitored repository counts as one unit against the plan allowance, whatever its size and however often it is scanned. Our team prepares a quote from your real repository list.
SonarQube and SonarSource are trademarks of SonarSource SA. WASViking LLC is not affiliated with or endorsed by SonarSource SA.
The SonarQube column reflects publicly available product documentation reviewed in September 2026. Features, editions and licensing terms vary by contract and change over time, so validate each row in your own evaluation. ACME figures on this page are illustrative data from a demonstration tenant, not customer results.