CodeScan

Avantages

It finds the right bugs and I've checked it against Checkmarx, it does the job well with less cost. I like the new feature "Security Hotspot", it has helped my team to work efficiently in writing secure codes.

Inconvénients

It doesn't report on individual scans. The report is tailored to the entire project and all the vulnerabilities that exist in your project. To this, it fails industry standard but it still does a good job.

Avantages

A fantastic polyglot static code analyzer all wrapped into a single UI.

Typically we would need to set separate integrations using language specific libraries and scan each file accordingly but a single CodeScan setup handles them all.

CodeScan handles all major languages so even if the repo has a mix of Java, PHP, JS, etc, it out of the box applies best practices to ensure code quality.

It also works across repos/projects which is great.

Inconvénients

I think I recall that there is an issue when running on branches of branches where upstream is merged but we run into so infrequently it's not really a problem. We just point the branch back at master and rerun.

Very rarely, but it has happened, there is a rule that may be incorrect due to context. Ignoring these is simple, but then the email that it's been ignored is shot off and then the questions start rolling in. There is probably a way to avoid the email getting sent out but I haven't looked into it yet.

Once again, really rare.

Avantages

The code scanning feature, the ease of performing most task with the app is what amazes me with the app.

Inconvénients

I love everything about the app so far, especially the ease of adapting to it.

Avantages

Excellent documentation and a fair pricing model. Integrates with our DevSecOps CI/CD tool (Copado) seamlessly.

Inconvénients

Email reports are not beneficial for reporting to Security leadership, would like better options. Also all reports are emailed, you cannot select which project to email.

Avantages

This was a very easy tool to set up, train and adopt. We onboarded a lot of users in very little time.

Inconvénients

Would help if they had more documentation

Avantages

Fits nicely with the overall Sonar offering
Extensive libraries of rules and frequently updated
Great support

Inconvénients

Not applicable - Code Scan was very receptive to our feedback and acted swiftly

Avantages

Ease of using, works nice with Jenkins pipeline. Good interactive dashboard

Inconvénients

Hmnn. Nothing so far. In my daily work, it seems to work pretty good

Avantages

Easy to use. Easy to understand. Easy to implement. Great Value for money.

Inconvénients

It would be good somehow to be able to upload my own rules to it. But I understand how difficult this would be.

Avantages

ease of install and deployment, good number of checks on code lines

Inconvénients

native integration with git or other source control tools

Avantages

Easy installation and high number of checks on the code (rules)

Inconvénients

Not integrated with opensource SCM like Gitea

Avantages

I really like the real-time integration with Intellij. It was very easy to install and setup. Very helpful from a developer standpoint.

Inconvénients

It seems a little buggy when you actually fix a suggestion. It doesn’t seem to remove the suggestion from the right side.

Avantages

Filter the bad code and help us to correct our code

Inconvénients

Sometime gives irrelevant errors, actually there is no error

Avantages

Code Smells feature and the slick UI which is so easy to use.

Inconvénients

There is nothing that I like the least about this.

Avantages

1. Comprehensive list of code related areas in a report which can be sliced and diced and presented to client.

Inconvénients

1. Robust reporting capabilities which can give options to slice and dice using different criterias.