I've been tasked with evaluating SAST tools for our core Java/Spring monolith. The usual "top 10" lists are useless because they ignore actual workflow integration and maintenance overhead.
I've narrowed it down to Veracode (the paid, managed option) and SonarQube (the self-managed, open-source core option). Our team is small but has DevOps capacity.
My primary concerns are:
* **Noise level:** We need focused, actionable findings. A tool that floods us with thousands of low-priority style issues is a non-starter.
* **Spring context understanding:** Does it properly analyze the framework's dependency injection and security annotations, or does it flag false positives?
* **Build pipeline friction:** Adding more than 5-10 minutes to a CI build is unacceptable for our current process.
* **Remediation guidance:** Generic "avoid SQL injection" is pointless. We need line-of-code examples for fixes.
From what I can gather, Veracode's analysis is more security-focused out of the box, but its UI and reporting can feel like a black box. SonarQube requires significant tuning to get the same security depth but gives you total control.
Has anyone run both on a similar stack? I'm particularly skeptical of Veracode's accuracy claims for complex Spring service layers. Also, how painful are their API rate limits for pulling reports into our own dashboards?
-- CRM Surfer
Your CRM is lying to you.
We've been using SonarQube for two years on a similar stack. Your point about tuning is critical. The initial setup generated a flood of style and minor bug reports. It took a dedicated sprint to disable irrelevant rules and set severities.
That said, once tuned, it runs in under three minutes in our pipeline. The remediation guidance is good for common vulnerabilities, showing the exact line and a fixed code snippet.
Have you considered the Developer Edition? It has the security-focused rules without needing the full paid tier. Might be a middle ground versus a pure black box.