heygrc and SonarQube

Different jobs, same pull request.

SonarQube analyzes the code itself: bugs, vulnerabilities, and code smells, with a quality gate before merge. heygrc reasons about something different, your specific compliance obligations, and cites the control a change touches. They look at different layers of the same pull request, and a change can be solid code and still raise a compliance question.

Get early access by ISMS Copilot

SonarQube

SonarQube (Cloud and Server) is a static analysis platform. It scans pull requests for bugs, vulnerabilities, and code smells and enforces a quality gate before merge.

heygrc

heygrc reviews each pull request against the compliance frameworks your company must meet (ISO 27001, SOC 2, GDPR, and more) and cites the specific control a change touches. It is built for compliance, not code quality.

Where they do not overlap

Solid code that stores a full card number.

This change records the full card number alongside the order in an analytics table. It is valid code, and it runs.

billing/analytics.ts+1 −0

await analytics.insert({  orderId: order.id,+  cardNumber: payment.pan,  amount: order.total,})

heygrcPCI DSS Requirement 3

Storing the full card number in an analytics table keeps account data the system has no reason to retain, which PCI DSS Requirement 3 is built to limit. heygrc reads the change against the framework and names the requirement it touches.

Use them together

Keep SonarQube. Add the compliance layer.

This is not a question of which tool wins. SonarQube catches the bugs and quality problems heygrc never looks for, and heygrc catches the compliance issues a code review is not built to see. Running both means a pull request is checked for whether the code is good and for whether the change is compliant, two different kinds of risk, on the same diff.

heygrc does not replace your code review, and it does not certify you. It reviews changes against your frameworks and cites the control, so the compliance question is answered where the change is made. heygrc is in early access.

Get early access ← Where heygrc fits

Questions

heygrc and SonarQube, common questions.

Is heygrc an alternative to SonarQube?

Not exactly. SonarQube reviews your code; heygrc reviews each change for compliance against the frameworks your company must meet (ISO 27001, SOC 2, GDPR, and more) and cites the specific control it touches. They answer different questions about the same pull request, so heygrc is designed to run alongside it, not replace it.

Can I use heygrc and SonarQube together?

Yes. They look at different kinds of risk on the same diff: SonarQube on the code, heygrc on the compliance control a change touches. heygrc does not replace your code review.

What does heygrc check on a pull request?

heygrc reviews each pull request against the frameworks your company selected and cites the specific control a change touches, so the compliance question is answered in code review. heygrc does not certify you and is in early access.