SonarQube is run during the creation of pull requests, and the merging of branches to identify bugs, "code smells", and security vulnerabilities. If issues are found, the pull request is denied and must re-enter the development cycle.