Our take
Pick Semgrep if appSec / eng teams who will stay on Free $0 (10 repos, 10 contributors, Code + Supply Chain, GitHub/GitLab auth) while they scan a first repo, then buy Teams Code at $30/contributor/month when they need Pro rules, SSO, and 20 AI credits — and add Secrets at $15 only when they want a leak scan. Pick SonarQube Cloud if repo teams who will stay on Free forever (private projects up to 50k LOC, or public
AppSec scan desk
Best for
Semgrep Findings you start at $0
SonarQube Cloud Quality-gate health you start at $0
Free plan
Semgrep $0 · /month/contributor. Scan up to 10 repositories. Maximum 10 contributors. GitHub/GitLab auth. Includes Code ($0) and Supply Chain ($0). Community support
SonarQube Cloud $0 · sonarQube Team Plan free for private projects up to 50k LOC. No card, no expiry. Public OSI-licensed repos get SonarQube for OSS free forever
Lowest paid
Semgrep Teams $30/mo
SonarQube Cloud Gitar $20/mo yearly
Runs where
Semgrep
SonarQube Cloud Hosted
Watch out
Semgrep Free is 10 repos and 10 contributors
SonarQube Cloud Free private analysis stops at 50k LOC
Last checked
Semgrep 2026-10-22 · semgrep.dev/pricing
SonarQube Cloud 2026-10-23 · sonarsource.com/plans-and-pricing
appSec / eng teams who will stay on Free $0 (10 repos, 10 contributors, Code + Supply Chain, GitHub/GitLab auth) while they scan a first repo, then buy Teams Code at $30/contributor/month when they need Pro rules, SSO, and 20 AI credits — and add Secrets at $15 only when they want a leak scan.
Read the Semgrep pagerepo teams who will stay on Free forever (private projects up to 50k LOC, or public OSI-licensed repos) while they open a first Overview, then buy Team at $34 / month for up to 100k LOC.
Read the SonarQube Cloud page