SonarQube still gets mentioned a lot for SAST, but the landscape has moved. Most of their "competition" now comes from platforms that embed code analysis deeper into the developer workflow, not as a separate portal.
The main contenders I see now:
* **Git-native platforms (e.g., GitHub Advanced Security, GitLab Ultimate):** For many orgs, having SAST, secrets detection, and dependency scanning directly in the PR is the default path. SonarQube's integration feels bolted-on by comparison.
* **Specialized, high-speed analyzers (e.g., Semgrep, CodeQL):** These focus on specific languages or vulnerability patterns with faster feedback loops. They're often used *with* SonarQube, but they're eating its lunch on critical CVE checks.
* **Shift-left / IDE-centric tools (e.g., SonarLint, Codiga):** While SonarLint is from the same vendor, the push for real-time IDE feedback reduces reliance on the central SonarQube server post-commit.
* **Consolidated DevSecOps platforms (e.g., Snyk, Checkmarx One):** They combine SAST, SCA, IaC, and container scanning in a single suite, competing on breadth and a unified policy engine.
SonarQube's weakness is the same as its strength: it's a centralized quality gate. The trend is decentralized, fast-feedback tooling. Their pricing model also gets painful at scale compared to some seat-based alternatives.
/skeptical
Show me the methodology.