All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Sonar sells SonarQube, software that checks source code for quality and security problems without running it, to buyers ranging from small development teams to regulated enterprises. Founded in 2008, Sonar also sells AI agents that fix code and find security flaws, including Gitar, which it bought in May 2026. Sonar says 7 million developers and more than 75% of the Fortune 100 rely on SonarQube. Its named customers include Nvidia, Goldman Sachs, Ford, the FBI and NASA. In 2022 it raised $412 million at a $4.7 billion valuation in a round led by Advent International and General Catalyst. Sonar is hard to replace where teams require code to pass SonarQube’s checks before it merges, since those checks run in pull requests, build pipelines and developers’ editors.
| Description | Sonar builds SonarQube, an integrated code quality and security platform that analyzes first-party, third-party, and AI-generated code across 40-plus languages with SAST, cross-file taint analysis, software composition analysis, and secrets detection, as self-managed Server and cloud SaaS. | [f1] |
|---|---|---|
| Founded | 2008 | [f2] |
| HQ | Geneva, Switzerland | [f3] |
| Funding | $457M total | [f3] |
| Latest funding | $412M Series at a $4.7B valuation (April 2022), led by Advent International and General Catalyst | [f4] |
| Product | What it does |
|---|---|
| SonarQube | Integrated code quality and security platform with 7,000-plus rules, SAST, taint analysis, SCA, secrets, and IaC scanning across 40-plus languages, as Cloud SaaS and self-managed Server. |
| SonarQube Advanced Security | Advanced SAST with cross-file taint analysis plus SCA that reviews AI-generated, first-party, and open-source dependency code for hidden vulnerabilities. |
| SonarQube for IDE | Free in-editor companion (formerly SonarLint) that flags quality and security issues in real time and syncs rules with the platform via connected mode. |
| Gitar | AI-native code review agent that reviews pull requests, diagnoses CI failures, and commits fixes for human and AI-agent code, acquired by Sonar in May 2026. |
| Sonar Vortex | Injects codebase context into AI coding agents and verifies AI-generated code in real time to cut token cost and catch problems before the pull request. |
| SonarQube Remediation Agent | AI remediation agent that fixes SonarQube-detected issues and validates each fix against the Sonar analysis engine before proposing it. |
| MCP Server / SonarQube CLI | MCP server and CLI that connect SonarQube code intelligence to AI assistants and IDEs so agents can find and fix issues autonomously. |
| SonarQube Hunter Agent | AI security agent that runs curated playbooks across SonarQube projects to find broken access control, business-logic, and authentication flaws. |
| SonarSweep | Early-access tool that cleans and validates training datasets for coding LLMs by deduplicating, fixing issues, and filtering noise. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
SonarQube's AI Code Assurance workflow tags AI-generated code and holds it to a dedicated quality gate before it reaches production. This workflow is mapped to the AI Defense Matrix. [f5]
Cyber Defense Matrix
| Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|
| Devices Workstations, servers, phones, tablets, storage, network devices, IoT infrastructure, and similar hardware. | |||||
| Applications Software, interactions, and application flows on the devices. | |||||
| Networks Connections and traffic flowing among devices and apps, plus communication paths. | |||||
| Data Content at rest, in transit, or in use across devices, apps, and networks. | |||||
| Users The people using the devices, apps, networks, and data. |
SonarQube provides static application security testing, taint analysis, software composition analysis, and secrets detection on conventional application code, and this conventional security is mapped to the Cyber Defense Matrix. [f6]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Sonar names its buyer, the development and application-security teams that must verify code before it merges. SiliconANGLE’s own reporting describes AI coding tools producing more code than teams can keep up with. Sonar reports that teams using it are 44% less likely to have outages caused by AI-generated code. The captured quotes contain no independent measure of the problem’s scale. [s1, s7, s6] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 4/5 | Sonar documents its engine in detail, including more than 7,000 language-specific rules and cross-file taint analysis. Its dependency-aware mode traces data into third-party libraries for Java, C#, JavaScript, and TypeScript. Outside validation points exist, since the Community Build source is public on GitHub under the LGPL and SiliconANGLE reported strong SWE-bench results for AutoCodeRover, which Sonar bought. No independent benchmark of SonarQube’s own detection appears in the cited sources, so the outside validation stops short of the detection itself. [s1, s3, s28, s20] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 3/5 | Sonar argues that AI coding agents now write more code than teams can review. SiliconANGLE’s 2026 reporting describes the same pressure from tools such as Cursor, Claude Code, and GitHub Copilot. Sonar’s own pages report that Gartner created a Technical Debt Management category in 2026. No independently documented buyer-side signal, such as RFP language or budget lines, appears in the cited sources, so the demand evidence stays indirect. [s7, s23, s8, s3] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 4/5 | Olivier Gaudin co-founded Sonar in Geneva in 2008 with Freddy Mallet and Simon Brandhof and now chairs it, while Tariq Shaukat leads it as CEO. Its acquisitions added named builders of developer tooling. SiliconANGLE identifies Gitar’s founders as former Uber engineers, whom Sonar credits with building Uber’s centralized developer platform, and it reported AutoCodeRover’s SWE-bench results. [s17, s27, s7, s6, s20] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 4/5 | Sonar names many customers in its own materials, including Freshworks and federal agencies such as the FBI and NASA. Freshworks’ head of DevOps describes security analysis and secret detection on every pull request across more than 2,000 repositories. These names and the 7 million developer count are Sonar’s own figures, and SiliconANGLE relayed the company’s 2022 count of 20,000 paying customers, so the scale is not independently measured. [s1, s6, s12, s39, s9] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | Sonar raised $412 million in 2022 at a $4.7 billion valuation, bringing its total raised to $457 million. It has since bought AutoCodeRover and Gitar and released agent products such as Hunter Agent. Olivier Gaudin, then CEO, told SiliconANGLE in 2022 that annual revenue run rate was $175 million and growing 50%. No later revenue figure appears in the cited sources, so the shipping is visible while output per dollar is unconfirmed. [s9, s12, s17, s6, s18] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | Buyers can place SonarQube in code quality and code security testing. SiliconANGLE used those terms in 2026 when it called Sonar an automated code quality and security heavyweight. Sonar displays a Leader placement in Gartner’s 2026 Magic Quadrant for Technical Debt Management Tools on its own page, so that recognition is vendor-displayed rather than independently confirmed. [s17, s7, s8, s2] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | An arXiv study of 265 SonarQube Cloud projects found 75% using the organization's default quality gate, a set of conditions code must meet to pass automated checks (s15). Sonar synchronizes rules and analysis settings across IDEs and CI/CD pipelines, and Freshworks says every pull request now passes its quality gate checks (s1). That enforcement is friction to absorption. The deployment testimony is Sonar-hosted, and no source shows a structural moat that bundling could not eventually replicate, so the score is 3. [s15, s1] |
Sonar sells to the development and application-security teams responsible for the code their engineers and AI agents ship. It frames the problem as verifying that code before it merges. Its SAST page argues that code now ships faster than any human review cycle. SiliconANGLE’s 2026 reporting describes tools such as Cursor, Claude Code, Devin, and GitHub Copilot producing more code than teams can keep up with.
Sonar reports product outcomes and detection performance. Sonar reports that teams using it are 44% less likely to have outages caused by AI-generated code. It also cites a false positive rate below 3.2% across 137 million findings in 2025. The cited sources include no independent study that sizes the same pain.
According to Sonar’s pages, Gartner treats technical debt management as its own market. Sonar displays a Leader placement in Gartner’s 2026 Magic Quadrant for Technical Debt Management Tools. Its Remediation Agent page says Gartner created that category in 2026. [s3, s7, s6, s8, s23]
SonarQube is a static analysis platform that reviews code quality and code security in one pass. It applies more than 7,000 language-specific rules across more than 40 languages and frameworks. It traces untrusted data across files and functions, detects leaked secrets, and scans infrastructure-as-code. Advanced Security adds software composition analysis and malicious-package detection. Its dependency-aware taint mode covers Java, C#, JavaScript, and TypeScript.
Sonar sells the same analysis in several forms. SonarQube Cloud is the managed service, and SonarQube Server runs on a customer’s own infrastructure. The free SonarQube for IDE extension flags issues as a developer types, in editors such as VS Code and Cursor.
A set of AI agents now runs on top of the engine. Gitar reviews pull requests and commits fixes within rules a team defines. The Remediation Agent re-checks each generated fix against Sonar’s analysis before opening a pull request. Hunter Agent runs curated security playbooks to find access-control and business-logic flaws. Sonar Vortex supplies project context before coding and verifies changes as agents work. The MCP server integrates SonarQube’s static analysis into AI workflows. [s1, s3, s2, s4, s26, s21, s23, s32, s22, s24]
Sonar competes on breadth under one engine. One quality gate covers code quality and code security for human-written and AI-generated code. Sonar therefore competes with dedicated application-security vendors for security budgets. It also competes with GitHub, since Sonar publishes a comparison page against GitHub Code Quality.
Sonar has extended the engine into AI review and fixing through acquisitions. It bought AutoCodeRover in February 2025 and Gitar in May 2026. SiliconANGLE describes the Gitar deal as moving Sonar from static analysis toward agentic reasoning. Sonar keeps selling Gitar as a standalone product and also offers it with SonarQube.
Sonar’s displayed analyst recognition is in technical debt management. A buyer weighing SonarQube against security-focused rivals finds Sonar’s Gartner Leader placement in that category. Sonar’s security claims, such as its false positive rate, appear on Sonar’s own pages, so a security buyer working from the cited sources relies on Sonar’s data for the security case. [s3, s1, s7, s6, s17, s8]
Sonar reports a large developer footprint and names customers across industries. Its pages count 7 million developers and 75% of the Fortune 100. Its press releases name teams at Nvidia, ServiceNow, Goldman Sachs, Deutsche Bank, AstraZeneca, and Ford. Its product page also presents customer testimony under a Trusted by heading, including from Freshworks and Xero.
Sonar now names references for security use. Freshworks’ head of DevOps describes quality gates, security analysis, and secret detection on every pull request across more than 2,000 repositories. Xero’s security product lead describes all of the company’s code being checked as its use of AI tooling grows.
The public sector is a named segment. Sonar reports more than 1,000 live SonarQube Server instances at federal agencies, including the FBI, NASA, and the U.S. Department of Justice. The Department of Veterans Affairs lists SonarQube’s open-source edition in its Technical Reference Model.
Independent views of adoption are narrower. SiliconANGLE relayed Sonar’s 2022 figures of 5 million developers at 350,000 companies, 20,000 of them paying. An arXiv study of 321 GitHub projects using SonarQube Cloud found 75% of the accessible projects running their organization’s default quality gate. [s1, s6, s12, s39, s40, s9, s15]
Sonar pairs a founding chairman with a separate chief executive. Olivier Gaudin co-founded the company in Geneva in 2008 with Freddy Mallet and Simon Brandhof and now chairs it. Sonar’s leadership page lists Tariq Shaukat as chief executive officer.
Acquisitions brought in builders of developer tooling. Gitar’s founders, Ali-Reza Adl-Tabatabai and Gautam Korlam, are former Uber engineers. Sonar credits them with helping build Uber’s centralized developer platform, and they now lead Gitar inside Sonar. AutoCodeRover came out of National University of Singapore research, and SiliconANGLE reported its strong SWE-bench results.
The Swiss federal commercial register lists SonarSource Sàrl, seated in Vernier in the canton of Geneva, as an existing company in the Sonar Source group. Sonar’s web pages carry the SonarSource Sàrl name in their copyright line. [s17, s27, s6, s7, s20, s16, s2]
Sonar documents its security attestations in a public trust center. Its trust center states that the company holds ISO 27001:2022 certification and a SOC 2 Type II attestation for all products and services. The SOC 2 report is available under NDA.
Sonar offers deployment options for regulated buyers. SonarQube Server runs on infrastructure the customer controls, including air-gapped environments. Sonar publishes STIG-hardened container images in the Defense Department’s Iron Bank. The product reports against standards including NIST SSDF, OWASP, CWE, and STIG.
SonarQube is also server software with its own vulnerability history. The National Vulnerability Database records CVE-2024-47911, a blind SQL injection open to SonarQube administrators in versions 10.4 through 10.5. Sonar fixed it in version 10.6, and customers running SonarQube Server on their own infrastructure have to apply such fixes themselves. [s11, s19, s39, s4, s13]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Snyk | competes with | Competes for the same developer-led application-security buyer that SonarQube Advanced Security targets. | N/AWe captured the evidence for these companies under different evidence-model versions (v1 vs v2), so the totals were scored under different conditions and are not directly comparable. |
| Checkmarx | competes with | Competes for enterprise static analysis and software composition analysis budgets that SonarQube Server and Advanced Security also address. | |
| Semgrep | competes with | Competes for developer-adopted code scanning, overlapping SonarQube’s free and self-serve entry points. | |
| Black Duck | competes with | Competes for software composition analysis and static analysis budgets that SonarQube Advanced Security entered. | |
| GitHub | adjacent | Sonar publishes a comparison page against GitHub Code Quality. |
Add analyzed competitors to compare them side by side with Sonar.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Sonar is hard to replace where teams have built SonarQube into daily development work. Sonar synchronizes its rules to developers’ editors and enforces quality gates in pull requests and pipelines, so a team changing vendors would have to rebuild those gates and rule settings across its repositories. Sonar keeps a knowledge base of how popular open-source libraries handle data, built by scanning them. Its Hunter Agent uses curated prompts to find access-control, business-logic, and authentication flaws. Co-founder Olivier Gaudin said in 2022 that about three-quarters of the company’s code was open source and that the commercial version adds proprietary extensions. Sonar sells a self-hosted, air-gapped SonarQube Server to regulated buyers and names federal agencies among its customers.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 1/3 | Sonar sells software that customers run, as SonarQube Cloud or on their own SonarQube Server. The Remediation Agent produces fixes that the customer’s developers review and merge, so the customer’s team operates the product and owns the outcomes. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | Leaving SonarQube means rebuilding quality gates and the rule settings synchronized from the platform to every IDE and pipeline. Gitar’s review rules sit in the customer’s own repositories as plain-language files. That is integration and workflow friction. The cited record documents no network effect, non-portable state, or vendor-bound mandate, and it does not size the migration. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Sonar holds company-level ISO 27001:2022 certification and a SOC 2 Type II attestation, and it publishes STIG-hardened images in the Defense Department’s Iron Bank. A funded competitor can obtain those attestations and that hardening through ordinary preparation. The reviewed sources identify no product-carried authorization that would block a buyer from substituting another scanner. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | SonarQube turns source code into a structured map of classes, functions, and control flow, and it traces untrusted data across files. It also pre-scans open-source libraries to model where data enters and leaves them. Building cross-file analysis and library models takes years of specialized expertise. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | SonarQube Server is built for regulated buyers, with on-premises and air-gapped deployment. Sonar says enterprises in financial services, healthcare, and government use it, and it names the FBI, NASA, and the U.S. Department of Justice among federal agencies running it. Sonar also sells a self-serve plan to teams under 50 developers, and it names government buyers for SonarQube Server itself. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | SonarQube analyzes source code without executing it and returns pass or fail results at the pull request and pipeline. Its MCP server and Sonar Vortex pass context and findings to coding agents. Customer applications do not route their requests or workloads through it, so it is a platform with application features. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 2/3 | Sonar retains a knowledge base that its Advanced SAST engine builds by pre-scanning popular open-source libraries for the points where data enters or leaves a function. Hunter Agent runs curated playbooks that encode Sonar’s application security expertise. The scanned libraries are public, while the knowledge base and playbooks are Sonar’s accumulated work, replicable by a funded rival with time and effort. |
Sonar sells to the engineering organization that owns code quality and code security, from individual developers to large enterprises. A free Team plan covers private projects up to 50,000 lines of code. The paid Team plan serves groups under 50 developers without a sales call. The Enterprise plan for larger organizations is custom-priced.
Regulated and public-sector buyers are a deliberate segment. Sonar describes SonarQube Server as adopted by enterprises in financial services, healthcare, and government that must keep code on-premises. It reports more than 1,000 live Server instances across federal agencies, including the FBI, NASA, and the U.S. Department of Justice.
The newest segment is teams shipping AI-generated code. SonarQube flags code from generative AI tools and holds it to a dedicated quality gate. Sonar’s agent products target teams that use coding agents such as Cursor and Claude Code.
Sonar’s core advantage is deterministic static analysis across many languages under one engine. SonarQube applies more than 7,000 language-specific rules across more than 40 languages and frameworks. It traces untrusted data across files and functions and reviews quality and security together in a single quality gate.
Sonar offers dependency-aware taint analysis for fewer languages than the platform as a whole. Sonar’s Advanced SAST pre-scans popular open-source libraries to build a knowledge base of where data enters and leaves their functions. It then checks whether a customer’s code misuses those functions. That mode is available for Java, C#, JavaScript, and TypeScript.
Sonar layers AI agents on the engine. The Remediation Agent re-analyzes each generated fix with Sonar’s verifier and discards fixes that fail. Gitar commits fixes within rules a team defines. Hunter Agent runs curated playbooks, and Sonar says the agent uncovered more than 200 previously unknown vulnerabilities in open-source applications.
SonarSweep, in early access, cleans training data for coding models. Sonar reports a 41% reduction in bugs and vulnerabilities for one model trained on data it cleaned.
Sonar runs a bottom-up developer motion alongside enterprise sales. Sonar offers free entry points, including the open-source Community Build, the free IDE extension, and a free Team plan for small private projects. Teams can move to paid Team, Enterprise, and Server editions as they grow.
Sonar backs that motion with a long list of named customers. Its press releases name teams at Nvidia, ServiceNow, Goldman Sachs, Deutsche Bank, AstraZeneca, and Ford. Its product page presents testimony from Freshworks and Xero under a Trusted by heading. Sonar reports 7 million developers and 75% of the Fortune 100.
Acquisitions now add to the product line. Sonar bought Structure101 in October 2024 and agreed to acquire Tidelift in December 2024. It bought AutoCodeRover in February 2025 and Gitar in May 2026. Sonar keeps selling Gitar as a standalone product and also offers it with SonarQube.
Sonar publishes entry pricing and keeps enterprise pricing custom. Its pricing page lists SonarQube plans from $34 a month for analysis of up to 100,000 lines of code. A free tier covers private projects up to 50,000 lines, and organizations above 50 developers get custom pricing.
Sonar prices SonarQube by lines of code and Gitar by user or by pull request. SonarQube Server editions are priced per instance, per year, by lines of code, with custom quotes for its advanced editions. Gitar’s per-user plan costs $20 per user a month, billed annually, and its Enterprise plan is charged per pull request with unlimited iterations.
Advanced Security is the security upsell on top of the quality base. Sonar sells it with SonarQube Cloud’s Team and Enterprise plans and with SonarQube Server Enterprise.
Sonar delivers software that customers run, in the cloud or on their own infrastructure. SonarQube Cloud is the managed service. SonarQube Server runs on infrastructure the customer controls, including air-gapped environments. Sonar brought its agent products to Server with the 2026.5 LTA release on September 29, 2026.
SonarQube meets developers in the tools they already use. It decorates pull requests, fails pipelines through quality gates, and synchronizes rules to the IDE. It connects to coding agents through its MCP server and Sonar Vortex.
The agents change what Sonar’s products do to customer code. Gitar commits fixes to branches within rules the customer sets. The Remediation Agent opens pull requests that developers review before anything merges, so customers decide how much change the agents may make.
Sonar documents the attestations an enterprise buyer of code tooling checks. Its trust center states ISO 27001:2022 certification and a SOC 2 Type II attestation for all products and services. It also says Sonar’s build processes meet the requirements for the Defense Department’s Iron Bank image repository.
SonarQube Server serves buyers who cannot send source code to a SaaS provider. It runs on infrastructure the customer controls, including air-gapped environments. Sonar publishes STIG-hardened container images for it in Iron Bank.
Buyers can rely on these attestations in procurement reviews. A competitor can obtain ISO 27001 and SOC 2 through ordinary preparation. The reviewed sources identify no authorization tied to SonarQube that a federal buyer would lose by switching.
SonarQube has its own vulnerability history. The National Vulnerability Database records CVE-2024-47911, a blind SQL injection open to administrators in versions 10.4 through 10.5. Sonar fixed it in version 10.6, and customers running SonarQube Server themselves have to apply such fixes on their own infrastructure.
Sonar positions SonarQube as the verification layer for code from any source, human or AI. One engine covers quality and security, and Advanced Security extends it to open-source dependencies. A set of agents reviews code, fixes it, and hunts for flaws on top of that engine.
SonarQube connects to the tools developers and agents already use. SonarQube integrates with pull requests and CI pipelines. Its IDE extension runs in editors including VS Code and Cursor, and its MCP server lets coding agents query SonarQube’s analysis while they work.
Open source remains part of the platform. Sonar publishes the SonarQube Community Build on GitHub under the GNU Lesser General Public License. Its security research team discloses vulnerabilities it finds in open-source projects.
A Sonar co-founder chairs the company while Tariq Shaukat runs it as chief executive officer. Olivier Gaudin co-founded Sonar in Geneva in 2008 with Freddy Mallet and Simon Brandhof.
Acquired teams lead parts of the AI agent work. Gitar’s founders are former Uber engineers, whom Sonar credits with building Uber’s centralized developer platform, and they now lead Gitar inside Sonar. AutoCodeRover brought an agent built on National University of Singapore research.
The operating entity is Swiss. The federal commercial register lists SonarSource Sàrl in Vernier, in the canton of Geneva, as an existing company in the Sonar Source group.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | SonarQube product page | official | 2026-10-04 |
| f2 | Wikipedia: Sonar (company) | research | 2026-10-04 |
| f3 | SiliconANGLE: SonarSource lands $412M at a $4.7 billion valuation | press | 2026-10-04 |
| f4 | Sonar Raises $412 Million in New Investment | official | 2026-10-04 |
| f5 | AI Defense Matrix Catalog entry: Sonar AI Code Assurance | other | 2026-10-04 |
| f6 | SonarQube SAST solution page | official | 2026-10-04 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.