Hey everyone, been lurking for a bit. I'm mostly in the AWS/Terraform world, but my team is starting a new C++ project for embedded systems. The lead dev wants a static code analysis tool and is debating between SonarQube and Coverity.
I've only used SonarQube briefly for some Python scripts. For a C++ codebase, especially where memory safety and concurrency are critical, which one actually catches more real bugs? I hear Coverity is heavy but deep, and SonarQube is more of a platform.
Could someone with experience break down the real-world difference in bug detection for C++? Like, does one find more null pointer dereferences or buffer overflows that the other misses? We're a small team, so setup complexity matters too, but catching bugs is the priority.