00:00 Hi, everybody. Welcome to DEMO, the show where companies come in and showcase their latest products and services. I’m joined today by Harry Wang. He is the Vice President of Growth and New Ventures at Sonar. Welcome to the show, Harry. 00:11Thank you for having me, Keith. 00:12So, tell us a little bit about Sonar and what you’re going to show us today. 00:15Yeah, absolutely. Sonar is the company behind a very well-known product, SonarQube, widely used in the developer and DevOps community. We serve over 7 million developers, 400,000 organizations, and more than 20,000 commercial customers. 00:34So, is this product designed for individual developers, teams, or entire IT departments? 00:42Both, actually. Our company was started by developers for developers, so we are very much a developer-first organization. Our goal is to help developers write better code, stay productive, and ultimately build better applications. For organizations and IT departments, it’s about coordination — ensuring software quality and code integrity. 1:06And if you had to narrow it down, what is the key problem you’re solving for developers? What challenges are they facing that Sonar can help with? 1:17In two words: code quality. As companies undergo digital transformations, software has become one of their most valuable assets. And behind every software product is its code. Code is, I would argue, the largest asset a company has as it moves into the digital future — especially with the rise of AI.Nowadays, it’s not just humans writing code; AI is generating code as well. So, maintaining high-quality code is critical because it underpins the entire application development process. 1:49Are companies typically checking their code quality after development, or are you seeing more teams integrate it into the development process? 2:03Excellent question. For our audience — many of whom are in leadership roles within organizations — the concept of “shift left” should be familiar. As a developer-first company, we’ve always focused on the left side of the development process. So for us, it’s about getting the code right from the beginning — solving and preventing problems early. The cost of fixing issues is much lower when caught early in development, and it’s even better if those issues never occur in the first place. 2:37So, if a company doesn’t have a platform like Sonar, how would they typically handle code quality? Would they be manually reviewing everything post-development, or would they be using other tools? 2:49Often, the traditional process involves defining requirements, writing code, and then passing it through various testing phases — unit tests, integration tests, usability tests. If everything goes well, it goes into production. But the feedback cycle for detecting issues — whether during testing or in production — can be very long, sometimes stretching for months. Developers in the field often experience delays due to these extended feedback loops. Our goal is to shorten that feedback cycle significantly. 3:25All right, so the idea is to speed up the entire process. 3:27Exactly. 3:28Let’s take a look at what you’ve got. Show us some cool stuff. 3:31Yeah, sure. I’m going to jump into the SonarQube UI. This is a self-hosted version, but we also offer a SaaS solution. This is the home view, where you can see multiple projects. For roles like Head of Engineering, Platform Engineering, or Developer Experience, managing many applications and projects is a daily task. We have a concept called portfolios, which helps different stakeholders organize projects they care about. These are self-defined — so, for example, a CIO might want visibility into all projects across the organization. Here, you can see different metrics that leadership cares about, organized by product. You get a high-level overview, but you can also drill down into individual projects. If you’re concerned about releasability, for example, this tells you if a project has issues preventing it from being built or deployed. Or, if you’re the CISO, security is your priority. You can see security metrics across different projects. Reliability is another key factor — things like race conditions between threads or memory leaks. So, we measure various aspects of the code depending on its state. Whether you’re a team lead or a senior leader, you can generate customized reports. 5:15And I see you’re giving letter grades. That reminds me of school. 5:20Exactly, same concept! 5:22If you go back to your projects or portfolio… you had a lot of Ds on one of them. 05:29Yes, if a project has a D (or worse, an E), that’s a major red flag. Let’s take an example. My favorite language is Java, so let’s pick one of those projects. You can see this project has an E rating — definitely something that requires attention. We also have something called a quality gate. This is a concept we introduced to help organizations define stopping criteria. Essentially, if a project doesn’t meet certain standards — whether due to security issues, maintainability concerns, or lack of unit test coverage — it fails the quality gate. That means it cannot move forward until the team resolves the issues. Let’s drill into that. You can see the product failed, but you also get insights into what’s happening with new code and the overall codebase. Development teams typically work on small portions of a codebase at a time. It might contain millions or even tens of millions of lines of code, but during a sprint, they may only be touching a few files. They can choose to focus on just the new code or take a broader view — paying off technical debt and refactoring where needed. If I know there are 18 issues, I can drill down into them and see what’s causing the failure. As a developer or technical lead, I can investigate each issue, assign tasks, and ensure they’re addressed early in the sprint. You can also categorize issues — whether they’re security vulnerabilities, readability concerns, or maintainability challenges. And of course, security is always a major concern. Here’s an example — this is a user-controlled code vulnerability, which could
