SonarQube Alternate Sources
Overview
Buyer
Place of Performance
NAICS
PSC
Set Aside
Original Source
Timeline
Qualification Details
Fit reasons
- NAICS alignment with historical contract wins in similar service areas.
- Scope strongly matches core technical capabilities and delivery model.
Risks
- Past performance thresholds may require one additional teaming partner.
- Potential clarification needed on staffing minimums before bid/no-bid.
Next steps
Validate eligibility requirements, assign capture owner, and schedule partner outreach to confirm teaming strategy before submission planning.
Quick Summary
The Department of the Air Force, through AFLCMC HNCK C3IN, is conducting market research via a Request for Information (RFI) to identify commercially available alternatives to SonarQube. This effort supports Platform One (P1) mission requirements for enterprise software code quality analysis, static application security testing (SAST), and software compliance within a Government security-compliant DevSecOps environment. Responses are due May 12, 2026.
Purpose
This RFI is issued solely for market research and acquisition planning to evaluate industry capabilities and available solutions. The Government seeks to identify solutions capable of supporting secure software development lifecycle (SDLC) practices, automated code inspection, vulnerability identification, coding standards enforcement, quality gate management, developer workflow integration, and enterprise scalability across Platform One value streams and software delivery pipelines. The goal is to identify qualified sources, evaluate alternative technical capabilities, and inform future acquisition strategy decisions.
Scope of Interest
The Government is interested in solutions that provide:
- Enterprise software code quality analysis, SAST, code vulnerability detection, and technical debt analysis.
- Software compliance support within a Government security-compliant DevSecOps environment.
- Capabilities for secure SDLC, automated code inspection, vulnerability identification, and coding standards enforcement.
- Quality gate management, developer workflow integration, and enterprise scalability.
Information Requested from Vendors
Respondents should provide details on:
- Company Information: Legal name, CAGE Code, UEI, business size, socioeconomic status, POC, and three relevant enterprise implementations.
- Technical Capability: Code analysis capabilities (bugs, vulnerabilities, code smells, security hotspots, duplications, technical debt), supported languages, alignment to CWE, OWASP Top 10, STIG, NIST SSDF, CI/CD integrations, and API extensibility.
- Enterprise Capability: Maximum supported Lines of Code (LOC), multi-tenant and Role-Based Access Control (RBAC) capabilities, reporting/dashboard features, and data ownership/storage/retention controls for on-prem environments.
- Support: Description of the support model, escalation procedures, and confirmation of ability to deliver license keys within 5 business days After Receipt Of Award (ARO).
- Pricing: Information on base year and option years.
Contract & Timeline
- Type: Sources Sought / Request for Information (RFI)
- Set-Aside: None specified; open competition encouraged.
- Response Due: May 12, 2026, by 5:00 PM ET
- Published: May 5, 2026
- Place of Performance: San Antonio, TX (for potential future requirement)
Additional Notes
This RFI is for informational and planning purposes only and does not constitute a solicitation, request for proposal, or a commitment by the Government to award a contract. Responses will assist in identifying qualified sources and informing future acquisition strategy.