SonarQube in Malaysia: licences, setup and training for your development team

Sonar lists SonarQube Cloud Team from US$34/month for up to 100k lines of code, currently shown as a discounted rate, so check it before you budget. The Cloud Enterprise plan is custom-priced, and the self-managed Server editions are priced per instance, per year, by lines of code; both are quoted. Tell us your total lines of code and team size and we will send a quotation.

On SonarQube Cloud, only private projects count; SonarQube Server counts every analysed project. Both count only the largest branch of each project. How often you run analysis does not change the count.

Cloud suits teams who want nothing to install or maintain. Server suits teams that must keep code on their own infrastructure. We can quote both and help you decide.

It analyses only the main branch. It does not analyse feature branches or pull requests, and it cannot show results inside your pull requests. Paid editions add both.

We are a Sonar reseller partner in Malaysia and Singapore. We supply SonarQube licences and provide setup and training alongside them.

Our SonarQube team workshop can be claimed through HRD Corp by Malaysian employers. Onboarding is already included with every licence we supply.

On SonarQube Server, standard commercial support is available on every edition, Developer included, at additional cost; it is included in Enterprise plans from 30M lines of code. 24/7 premium support is available on Enterprise. We itemise support options in your quote, and we handle setup, integration and first-line questions for the teams we supply.

AI CodeFix is included in SonarQube Server Enterprise and in the SonarQube Cloud Team and Enterprise plans; it is not in the Developer edition. The Remediation Agent is a separate subscription: on Cloud it comes with Sonar Agent Essentials on the Team plan (billed annually) or the Enterprise plan, and on Server it needs the Enterprise edition, version 2026.5 or later. We quote the edition and the agent subscription together.

No. Advanced Security is a separate subscription, on SonarQube Server Enterprise and on the SonarQube Cloud Team and Enterprise plans. Core SAST, taint analysis and secrets detection are already in SonarQube Server from the Developer edition up; Advanced Security adds dependency scanning, SBOM export and advanced SAST into third-party libraries.

Sonar sells three agents: Sonar Vortex, which guides and checks a coding agent while it writes; the SonarQube Remediation Agent, which opens fixes for your backlog as pull requests; and the SonarQube Hunter Agent, which looks for logic and access-control flaws. Each is a separate subscription. On SonarQube Cloud, Vortex and the Remediation Agent come with Sonar Agent Essentials (Team plan billed annually, or Enterprise) and the Hunter Agent needs the Enterprise plan. On SonarQube Server, all three need the Enterprise edition, version 2026.5 or later. As a Sonar reseller partner we quote them in Ringgit with your licence and set them up on your repositories.

Yes, as one control among several. Pull-request analysis and quality gates (Developer edition and up) support your evidence for source code reviews on changes to critical systems under RMiT S 10.10. The Enterprise edition adds compliance, PDF and regulatory reports and audit logs for due diligence, and the Advanced Security add-on exports an SBOM. SonarQube does not make you compliant, and dynamic and penetration testing stay separate. Banks usually run SonarQube Server Enterprise self-managed, because SonarQube Cloud has no Asia Pacific data region.

Gitar is an AI pull request reviewer that Sonar acquired in 2026. It reviews pull requests and commits fixes when CI fails. It is a separate Sonar product, sold on its own per user and also offered with SonarQube and Advanced Security; it is not included in a SonarQube licence. We resell it and quote it alongside SonarQube.