ComposalCode quality and security
Composal vs SonarQube
SonarQube analyzes code and configured rules. Composal exercises the running web app against browser expectations. Browser QA complements SonarQube and should not be treated as a substitute for static analysis.
Two workflows, side by side
Composal
Composal sends AI browser agents to use your running web app and check the outcomes you care about. Define journeys as plain-English Scenarios, map existing flows with Discovery, or explore for bugs with Deep Scan. Runs keep recordings and reproduction steps so your team or coding agent can investigate a Finding.
Verify documentation →SonarQube
Static analysis and quality gates for code changes
SonarQube Server and Cloud analyze source for reliability, security, and maintainability. Pull request analysis reports new issues and quality gate status.
What each tool does
“With setup” means you supply code or configuration. “Not confirmed” means support for this workflow needs checking with the vendor.
| Workflow | Composal | SonarQube |
|---|---|---|
| Run browser journeys | Yes Run saved browser Scenarios and return recordings and reproducible Findings. | No The documented product reviews or analyzes source changes; it does not execute browser journeys. |
| Map application workflows | Yes Discovery maps key application areas and user journeys. | Not confirmed Check whether this product includes this workflow in your intended plan and setup. |
| Explore for unexpected issues | Yes Deep Scan explores the running application and reports reproducible issues. | Not confirmed Check whether this product includes this workflow in your intended plan and setup. |
| Describe checks in plain English | Yes Author Scenarios around the intended user outcome, then review the steps and expected results. | Not confirmed Check whether this product includes this workflow in your intended plan and setup. |
| Run or inspect from a terminal | Yes Use the CLI to start and inspect verification runs and their Findings. | With setup Connect its specialist checks to your development workflow using supported integrations. |
| Source code review and analysis | No Use a dedicated tool for this specialist workflow alongside Composal’s browser verification. | Yes SonarQube Server and Cloud analyze source for reliability, security, and maintainability. Pull request analysis reports new issues and quality gate status. |
Where each fits
Choose SonarQube when code quality profiles, CI analysis, and quality gates are required. Choose Composal for deployed user journeys, exploratory browser checks, and Findings with reproduction evidence.
Try this evaluation
Run Sonar analysis and a Composal Scenario on the same preview change. Compare new-code findings and quality gate results with user-visible outcomes; keep separate ownership for code and runtime risks.
- Coverage
- Which user outcomes must this release prove, and which specialist checks must stay in your existing stack?
- Setup
- Who prepares accounts, test data, permissions and access to the deployment being tested?
- Evidence
- Can the engineer reproduce a reported failure from the recording and steps, without asking the tester to investigate again?
- Ownership
- Who updates the checks when the product changes, and can the team review what a passing result actually proves?