SonarQube FAQs
If you are using the SonarQube Community Edition, there is no restriction on the number of lines of code or the number of applications in SonarQube.
If you are using the SonarQube Enterprise Edition, each unit or block has a limit of 400K lines of code (LOC). If you scan more than 400K LOCs but less than 800K, we will charge you for two blocks or units of SonarQube.
For more details, refer to the SonarQube Enterprise edition’s usage and billing Policy.
LOCs are determined by summing up the LOCs from the largest branch of each project across all repositories in your subscription.
A daily scheduled job aggregates the LOCs, first at the project level (summing LOCs for all SonarQube applications within a project) and subsequently at the subscription level (summing LOCs for all projects within the subscription).
For each project, the LOCs from the largest branch of that project are summed.
For example, if Project A has two SonarQube applications:
Application A has 300K LOC (from the largest branch)
Application B has 500K LOC (from the largest branch)
The total LOCs for Project A = 300K + 500K = 800K LOC.
The LOCs for all projects under a subscription are summed to calculate the total LOCs for the subscription.
For example, if subscription A includes two projects:
Project A: 800K LOC (from the largest branch)
Project B: 500K LOC (from the largest branch)
Total LOCs for Subscription A = 800K + 500K = 1.3M LOC.
Yes, LOC count can vary daily as new code is added or removed. The daily scheduled job ensures that the most up-to-date LOC data is used for aggregation and billing.
Let’s say you purchase one block or unit of SonarQube Enterprise licence. If you scan more than 400K LOCs but less than 800K, we will charge you for two blocks or units of SonarQube.
If you scan 950 K LOCs, we will charge you for three blocks or units of SonarQube.
Regardless of whether you scan each repository separately or in parallel, we will charge based on the total lines of code (LOCs) under your SonarQube Enterprise subscription. Since you have 600K LOCs in total, exceeding the limit of one block, you’ll be charged for two blocks, irrespective of how you perform the scans.
We consider LOCs at the subscription level, summing up all LOCs across all repositories covered by your subscription to determine the billing.
Yes, your subscription admin will receive email alerts once you reach 80% of your purchased SonarQube Enterprise block(s) or units. If your usage is between 80% and 90%, you’ll receive weekly alerts, and if your usage exceeds 90%, you’ll receive daily alerts.
Subscription Admins can also check the LOC in your projects on Console.
No. SonarQube Enterprise licences are based on blocks of lines of code (LOC) scanned, not the number of projects. Each block covers up to 400K LOCs.
C, C++, Obj-C, Swift, ABAP, T-SQL, PL/SQL are supported. Public officers can refer to the pricing for the add-ons.
Yes. SonarQube can scan for any customisation that the COTS product supports. Example: Configuration files in XML or Javascript/ Java or plugins written in Java or Python.
There are 2 options to enable .xml file scanning in SonarQube Enterprise edition. Before you decide to include XML files in SonarQube scanning, keep in mind that doing so will use up your Lines of Code (LOC). For more details, refer to SonarQube’s Fair Usage Policy.
Option 1: Override source file exclusion in SonarQube dashboard
- Go to your project in the SonarQube dashboard.
- Go to Project Settings > General Settings > Analysis Scope tab.
- Enter disabled-exclusion in the Source File Exclusion field.
Option 2: Override sonar.exclusions on SHIPHATS SonarQube template
If you are using .sonarqube-scan or .sonarqube-scan-maven, include the following CI/CD variable in your jobs:
SONAR_OPT_ARG: "-Dsonar.exclusions=disabled-exclusion".If you are using .sonarqube-scan-dotnet or .sonarqube-scan-dotnet-framework, include the following CI/CD variable in your jobs:
SONAR_OPT_ARG: "/d:sonar.exclusions=disabled-exclusion".
Yes. SonarQube Community Edition (CE) is considered a Static Application Security Testing (SAST) tool and can fulfil the IM requirements in Clause 4.1/S1 and 4.4/S2.
However, note the following:
Coverage and effectiveness: SonarQube CE meets the minimum SAST requirements but is not the most comprehensive option. Tools such as Fortify on Demand (FoD) SAST, GitLab SAST, or SonarQube Developer Edition (and above) provide broader coverage and deeper analysis.
Rule configuration: In SHIP-HATS, SonarQube is configured using the OWASP Top 10 to address common application security risks.
Recommendation: Agencies can use SonarQube CE to meet the minimum compliance requirements. However, using a more advanced SAST tool is recommended for improved detection and stronger compliance.
