Vettd vs SonarQube Cloud
which one fits your workflow?
SonarQube Cloud (formerly SonarCloud) is the hosted SaaS edition of the long-established SonarQube platform. The Sonar ruleset is the industry baseline for static analysis across 30+ languages, with mature coverage of bugs, code smells, security hotspots, and technical debt scoring. Free for public repositories; paid by lines of code for private repositories. SonarQube Server (self-hosted) is sold separately at $750/yr for the Developer edition.
TL;DR
Pick SonarQube Cloud if
- You're working in a polyglot codebase and want the long-established Sonar Way ruleset across 30+ languages — Java, Python, C#, C++, Go, Kotlin, Scala, TypeScript, etc.
- You need detailed technical debt scoring, code smells categorisation, and the Sonar quality gate framework that's standard practice in mature engineering orgs.
- You want self-hosting (SonarQube Server, sold separately starting at $750/yr Developer edition).
- You're an OSS maintainer with public repos — SonarQube Cloud is free for public projects.
Pick Vettd if
- You're working in modern web (TypeScript / Next.js / React) and want code rules tuned for the AI-assisted-code patterns Sonar doesn't flag specifically (NEXT_PUBLIC secret leaks, "use client" misuse, hardcoded LLM API keys with exact regex patterns).
- You want the live deployed-site audit on top of code review — Sonar is code-only.
- You want auto-generated patches shipped as Markdown for AI agents (Claude Code / Cursor / Windsurf).
- You want AEO checks (llms.txt, citable schema, FAQPage), CRO checks (CTA contrast, headline grading), and completeness checks — none of which a static analyzer covers.
- You don't want to think about LOC-based pricing scaling unpredictably with codebase growth.
At a glance
Side by side, in one breath.
Who picks which
A recommendation for your situation.
SonarQube is the canonical tool here. Sonar Way ruleset depth on Java, C#, C++, Python is unmatched. Technical debt scoring, quality gates, and Sonar metrics are well understood across the industry. Vettd is JS-focused on the code side and doesn't replace the core Sonar workflow.
Sonar covers TypeScript but with general-purpose rules; Vettd has rules specifically tuned for the AI-built-app stack — NEXT_PUBLIC secret leaks, App Router vs Pages Router migration gotchas, hardcoded Stripe / OpenAI / Anthropic key patterns. Plus the live-site audit on top. For this stack, Vettd is the more focused match.
SonarQube Cloud is free for unlimited public repositories with full ruleset access. Vettd doesn't have a free Code Review tier (Watch starts at $19/mo). For pure OSS work, SonarQube Cloud is the right cost choice.
Feature matrix
Every capability that matters, side by side.
37 rows across scanning, fixing, distribution, compliance, and team workflow.
| Feature | Vettd | SonarQube Cloud |
|---|---|---|
| Scanning | ||
Pull request decoration with inline comments | ||
Static analysis breadth (Java, C#, C++, Python, Go, etc.) | JS/TS focused | 30+ languages |
TypeScript / JavaScript code analysis | Specialized for AI-built apps | General-purpose |
Sonar Way rule set (industry baseline) | ||
Technical debt scoring Sonar's historic differentiator. | ||
Code smells categorisation | Partial | |
Security hotspots vs vulnerabilities distinction | ||
Quality gate framework | ||
Branch + PR analysis | ||
AI-generated code detection Sonar added this in 2024-25. | ||
Dependency CVE scan | Via Advanced Security add-on | |
Live URL audit (real browser) | ||
Web Vitals on the live site | ||
AI-graded legal pages + headlines | ||
AEO (AI search readiness) | ||
Completeness checks (Lorem ipsum, dead links) | ||
| Fixing | ||
Inline fix suggestions on PRs | Partial (recommendations) | |
Auto-generated code patches | AI CodeFix on Enterprise Server | |
Markdown export for AI agents | ||
AI-graded headlines + value props | ||
| Distribution | ||
GitHub App / decoration | ||
GitLab / Bitbucket / Azure DevOps | Roadmap | |
Self-hosted via SonarQube Server Server is a separate product, $750/yr Developer. | ||
IDE plugins (SonarLint) | ||
MCP server (Claude Code, Cursor, Windsurf) | ||
Embeddable status badge | Quality gate badge | |
Public REST API | Roadmap | |
| Compliance & trust | ||
OSS public-repo free tier | Site Scan only | Unlimited public repos |
Self-hosted deployment | No | SonarQube Server (separate, paid) |
SSO / SAML | On request | Enterprise editions |
SOC 2 Type 2 | Roadmap | Yes |
MISRA C++:2023 compliance checks | No | Enterprise Server |
Source code retention | Pulled, analyzed, discarded | Persisted (analyzers + history) |
| Team & workflow | ||
Pricing model | Per-project flat | LOC-based for Cloud; tiered annual for Server |
Multi-org admin | No | Enterprise editions |
Detailed project health insights | Score + trend graphs | Enterprise Server |
Annual billing discount | ~20% (Watch) | Server is annual-only |
Pricing breakdown
Tier by tier, in your local currency unit.
- 82 production-readiness checks
- Public report URL
- Embeddable badge
- Auto-generated fixes
- Markdown export for AI agents
- Money-back if no real issue caught
- 1 monitored project
- Code Review on every push
- Weekly auto re-scan
- AI QA on preview deploys
- 5 monitored projects
- Per-project trend graphs
- 10 monitored projects
- Unlimited public repositories
- Sonar Way ruleset
- PR decoration
- No private repos
- Private repositories
- Branch + PR analysis
- Sonar Way ruleset
- Quality gates
- GitHub / GitLab / Bitbucket / Azure DevOps PR decoration
- Self-hosted on your infrastructure
- 34 languages and frameworks
- AI-generated code detection
- Improved secrets detection
- Optional commercial support
- 40 languages and frameworks
- AI CodeFix
- MISRA C++:2023 compliance
- Project health insights
- Optional 24/7 white-glove support
Architecture & trust
Where data goes, what's persisted, what compliance covers.
| Vettd | SonarQube Cloud | |
|---|---|---|
| OSS public-repo free tier | Site Scan only | Unlimited public repos on SonarQube Cloud |
| Self-hosted deployment | Not available | SonarQube Server (separate, paid) |
| SOC 2 Type 2 | Roadmap | Yes |
| Industry-recognized quality framework | Vettd-defined scoring | Sonar Way + technical debt is industry standard |
| Source code retention | Pulled, analyzed, discarded | Persisted for analyzers + history |
| Pricing predictability | Flat per-project | LOC-based scales with codebase growth |
Migration & interop
How to move, or how to run both.
SonarQube and Vettd serve different audiences. If you use Sonar for the technical-debt scoring and quality-gate framework as a procurement / engineering-process artifact, don't migrate — those workflows are genuinely valuable and Vettd doesn't replace them. If you use Sonar primarily for "find issues in TypeScript PRs" and a chunk of the value is unrealised, Vettd Watch is cheaper and JS-focused. The realistic migration is reducing your Sonar surface to the languages where it matters and adding Vettd for JS + live-site coverage.
Both install as independent GitHub Apps with no conflict. Common configuration: Sonar for the core code-quality framework on backend services (Java, Python, etc.) and quality-gate enforcement, Vettd for the JS/TS frontend code review + live-site audit + AEO + completeness. The findings overlap is mostly basic security; Sonar's technical debt scoring is unique value, Vettd's deployed-site audit is unique value.
FAQ
Answers to the obvious follow-up questions.
Try Vettd against your own site.
Free Site Scan, no signup. 30 seconds. 82 production-readiness checks.