$ git diff main -- vs/sonarqube-vs-deepsource.md
For pure rule-based SAST with AI augmentation: SonarQubesrcremains the enterprise default thanks to LOC-based licensing and the AI Code Assurance add-on. DeepSource ($24 per user/month billed yearly, plus a per-line AI Review metersrc) wins on Autofix accuracy and platform breadth, but the cost argument that used to carry it is gone.
1-SonarQube Server: per-LOC. SonarQube Cloud Team: $11/user/mo.
2+DeepSource Team: $24 per user/month billed yearly, plus AI Review metered at $8 per 10K processed LOC on Standard or $15 on Advanced. Each user carries $10 of AI Review credit a month. Enterprise is customsrc
3At 50 devs DeepSource seats alone are $1,200/mo before any AI Review spend, against $550/mo for SonarQube Cloud Team at 50 users. SonarQube Server pricing depends on edition (Developer / Enterprise / Data Center) and LOC bucket.
4-DeepSource counts every member and administrator as a billable user. The active-contributor discount that used to favour it is gone.
1+DeepSource: Autofix promoted to default in 2025. High accept-rate on common defect patterns.
2+SonarQube: AI Code Assurance does suggestion-style fixes; less aggressive than DeepSource Autofix.
1Both publish PR status checks that can block merge. SonarQube's Quality Gates concept is the more mature governance surface. DeepSource's blocking is per-rule.
1From DeepSource to SonarQube: usually upmarket pressure (LOC-licensing accommodates the largest estates). Migration is a re-onboarding of rule sets, 2-4 weeks for a 1M LOC repo.
2From SonarQube to DeepSource: this used to be a cost-cut, and since the September 2026 reprice it is not. Move for Autofix, for four-platform coverage, or for the Harness roadmap, but price both before you commit.