Chose Veracode
Sonatype only identifies and scans third-party dependency and not custom-developed code—at least that's what it was doing back in 2018 when I used to utilize its services. Interface-wise, too, Veracode looks much cleaner and easier to navigate than Sonatype. Support and …
Invited by the Vendor
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info