Best Code Hotspot Analysis Tools in 2026

CodeScene is the established packaged tool for finding code hotspots from git churn and complexity. For free local use, repowise ranks hotspots with bug-fix counts, owners and code health beside each file, and code-maat gives raw churn and coupling data. SonarQube and Understand do other jobs. A one-line git command is enough for a first list.

Facts as of November 2026, from each vendor's own pages: CodeScene pricing, code-maat README, Understand docs.

What is a code hotspot?

A code hotspot is a file that changes often and is hard to change safely. Change frequency alone flags busy config files; complexity alone flags stable legacy code nobody touches. The product of the two points at the files where defects and slow reviews actually happen. The full method, with a command you can run today, is in git hotspot analysis: find the riskiest files, and code churn covers the churn half.

How we compared

I looked at four things:

• History: does it read git, and does it weight recent commits more than old ones.
• Quality signal: what it combines with churn to separate busy files from risky ones.
• Context: owners, bug-fix record and coupling beside each file.
• Where it runs: your machine, your CI, or a vendor's cloud.

CodeScene

CodeScene is a commercial platform that combines version-control history with its Code Health score to prioritise technical debt. Its Code Health page says the score covers 30+ programming languages and that its factors correlate with maintenance cost and defect risk (codescene.com/product/code-health). Pricing is per active author, counted as anyone who committed in the past three months, and open source projects are free (pricing).

Pick CodeScene if you want a hosted, supported product with delivery analytics and are happy to pay per author.

code-maat

code-maat is a command-line tool that mines version-control data and prints analyses as CSV. Its README lists churn analyses (abs-churn, author-churn, entity-churn), revisions, age, ownership analyses such as main-dev, and coupling, and it reads Git, Mercurial, Subversion, Perforce and TFS logs (GitHub). It is written in Clojure and licensed GPL-3.0.

It does not measure complexity. The usual recipe is to run revisions and join the result with a line count or complexity number from another tool, then sort by the product.

Pick code-maat if you want full control over the data and are comfortable scripting the join yourself.

git log scripts

One git command gives a usable churn ranking. This counts commits per file over the last 90 days:

git log --since="90 days ago" --name-only --pretty=format: | sort | uniq -c | sort -rn | head -20

It cannot tell a busy lockfile from a risky parser, so cross-check the top ten against file size or complexity by hand. Bug-fix commits, authorship and coupling take more scripting. This is the right first step and a poor last one.

SonarQube: a different kind of hotspot

In SonarQube, a Security Hotspot is a piece of security-sensitive code that a developer has to review, not a file ranked by change history. Reviewers mark each one Acknowledged, Fixed or Safe, and review priority comes from the rule's security category (SonarQube docs). That is useful security triage, and it is why the query "code hotspots" sometimes returns Sonar results. If you want churn times complexity, SonarQube is not the tool.

Understand

Understand by SciTools is a static analysis and metrics tool. Its docs page did not load for me today, so check its documentation for the metrics list. For hotspots, the churn half has to come from another source such as code-maat.

repowise

repowise ranks hotspots from your full git history and shows bug-fix count, bus factor and owner next to each file, locally and with no LLM key. Files are ranked by recency-weighted change frequency and prior bug fixes; a file counts as a hotspot when its churn is in the top quartile of the repository and it has real recent activity. Code health adds a per-file score from 59 deterministic detectors, with complexity as one input (git intelligence, code health).

uv tool install repowise
repowise init
repowise serve                          # open Hotspots
repowise risk --target src/pipeline/persist.py

repowise risk --target <file> prints the hotspot score, bug-fix record, owners and co-change partners for one file. The same data reaches coding agents through the get_risk and get_context MCP tools, two of repowise's ten MCP tools, and the PR bot on GitHub flags pull requests that touch hotspots. Workspaces rank across several repositories.

Pick repowise if you want hotspots, ownership, bug history and health in one self-hosted install, free for local use, and shared with agents.

How to choose

• Individual developer, want a list today: run the git command, then repowise init for the ranked view with owners.
• Team, no budget per seat: repowise for the ranked list; code-maat if you want CSV to feed your own dashboards.
• Management reporting and a supported vendor: CodeScene.
• Enterprise with many repos and governance needs: self-hosted repowise with workspaces and a commercial license; see the git intelligence page.
• Already own Sonar or Understand: keep them for quality rules and metrics, and add a churn source on top.
• What to do with the list: see untested hotspots and coverage priority.