VulnGraph vs SonarQube
Per-repo code quality and hotspots, meet cross-repo dataflow.
SonarQube is the de-facto standard for code quality, maintainability and security hotspots inside a single repository, with enormous adoption and tight CI integration. VulnGraph addresses a different question: how do untrusted inputs travel between your services and repositories to a sensitive sink? It builds one architecture graph across repos and propagates taint along it — the cross-boundary view SonarQube isn't built to produce.
| Capability | VulnGraph | SonarQube |
|---|---|---|
| Code quality / maintainability / coverageSonarQube's core strength. | — | ✓ |
| Single-repo security hotspots / SAST | ~ | ✓ |
| Cross-service dataflow / taint analysis | ✓ | — |
| Cross-repository architecture graph | ✓ | — |
| Blast radius & AI-access exposure | ✓ | — |
| SARIF / GitHub Code Scanning output | ✓ | ✓ |
✓ full · ~ partial · — not offered
When SonarQube fits
Choose SonarQube for continuous code-quality gates and per-repo security hotspots that every developer sees on every pull request.
When VulnGraph fits
Choose VulnGraph when the vulnerability spans repositories — an input in one service reaching a sink in another, which no single-repo quality gate can match.
Using them together
Pair them: SonarQube keeps each repository healthy on every commit; VulnGraph analyzes the architecture those repositories form. Both feed SARIF into a single view.