SonarQube is a self-managed open-source platform that helps developers create code devoid of quality and vulnerability issues. By integrating seamlessly with the top DevOps platforms in the Continuous Integration (CI) pipeline, SonarQube continuously inspects projects across multiple programming languages, providing immediate status feedback while coding. SonarQube’s quality gates become part of your release pipeline, displaying pass/fail results for new code based on quality profiles you customize to your company standards. Following Sonar’s Clean as You Code methodology guarantees that only software of the highest quality makes it to production.
This product is open source and very convenient.
This is open source.
This product is open source and very convenient.
This is open source.
Veracode is a global leader in Application Risk Management for the AI era. Powered by trillions of lines of code scans and a proprietary AI-generated remediation engine, the Veracode platform is trusted by organizations worldwide to build and maintain secure software from code creation to cloud deployment. Thousands of the world’s leading development and security teams use Veracode every second of every day to get accurate, actionable visibility of exploitable risk, achieve real-time vulnerability remediation, and reduce their security debt at scale. Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, and Penetration Testing.
Its complexity makes it quite expensive, but it’s all worth it, with all the engineering in the background.
The pricing is pretty high.
Its complexity makes it quite expensive, but it’s all worth it, with all the engineering in the background.
The pricing is pretty high.
Checkmarx One is an enterprise cloud-native application security platform focused on providing cross-tool, correlated results to help AppSec and developer teams prioritize where to focus time and resources.
The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security.
I believe pricing is better compared to other commercial tools.
The pricing is competitive and provides a lower TCO (total cost of ownership) for achieving application security.
I believe pricing is better compared to other commercial tools.
Snyk is a user-friendly security solution that enables users to safely develop and use open source code. Users can create automatic scans that allow them to keep a close eye on their code and prevent bad actors from exploiting vulnerabilities. This enables users to find and remove vulnerabilities soon after they appear.
We do have some missing licenses issues, especially with non-SPDX compliant one, but we expect this to be fixed soon
You can get a good deal with Snyk for pricing. It's a little expensive, but it is worth it.
We do have some missing licenses issues, especially with non-SPDX compliant one, but we expect this to be fixed soon
You can get a good deal with Snyk for pricing. It's a little expensive, but it is worth it.
Black Duck is a comprehensive solution for managing security, license compliance, and code quality risks that come from the use of open source in applications and containers. Named a leader in software composition analysis (SCA) by Forrester, Black Duck gives you unmatched visibility into third-party code, enabling you to control it across your software supply chain and throughout the application life cycle.
Depending on the use case, the cost could range from $10,000 USD to $70,000 USD.
The price is quite high because the behavior of the software during the scan is similar to competing products.
Depending on the use case, the cost could range from $10,000 USD to $70,000 USD.
The price is quite high because the behavior of the software during the scan is similar to competing products.
Mend.io is a software composition analysis tool that secures what developers create. The solution provides an automated reduction of the software attack surface, reduces developer burdens, and accelerates app delivery. Mend.io provides open-source analysis with its in-house and other multiple sources of software vulnerabilities. In addition, the solution offers license and policy violation alerts, has great pipeline integration, and, since it is a SaaS (software as a service), it doesn’t require you to physically maintain servers or data centers for any implementation. Not only does Mend.io reduce enterprise application security risk, it also helps developers meet deadlines faster.
We are paying a lot of money to use WhiteSource. In our company, it is not easy to argue that it is worth the price.
The version that we are using, WhiteSource Bolt, is a free integration with Azure DevOps.
We are paying a lot of money to use WhiteSource. In our company, it is not easy to argue that it is worth the price.
The version that we are using, WhiteSource Bolt, is a free integration with Azure DevOps.
SonarCloud is a cloud-based alternative of the SonarQube platform, offering continuous code quality and security analysis as a service. SonarCloud integrates seamlessly with popular version control and CI/CD platforms such as GitHub, Bitbucket, and Azure DevOps. It provides static code analysis to identify and help remediate issues such as bugs and security vulnerabilities. SonarCloud enables developers to receive immediate feedback on their code within their development environment, facilitating the maintenance of high-quality code standards, and promoting a culture of continuous improvement in software development projects. It helps produce software that is secure, reliable, and maintainable. SonarCloud is free for open-source projects and is offered as a paid subscription for private projects, priced per lines of code.
The price of SonarCloud could be less expensive. We are using the community version and the price should be more reasonable.
I am using the free version of the solution.
The price of SonarCloud could be less expensive. We are using the community version and the price should be more reasonable.
I am using the free version of the solution.
GitGuardian helps organizations detect and fix vulnerabilities in source code at every step of the software development lifecycle. With GitGuardian’s policy engine, security teams can monitor and enforce rules across their VCS, DevOps tools, and infrastructure-as-code configurations.
It's a little bit expensive.
The pricing and licensing are fair. It isn't very expensive and it's good value.
It's a little bit expensive.
The pricing and licensing are fair. It isn't very expensive and it's good value.
Apiiro is the leader in application security posture management (ASPM), unifying risk visibility, prioritization, and remediation with deep code analysis and runtime context.
Semgrep Code is a powerful tool for static code analysis, adept at identifying and rectifying security vulnerabilities and performance issues within codebases. It's valued for its ability to streamline code auditing processes and maintain consistent coding standards, which is essential for development teams. With the capability to automate code reviews, Semgrep Code seamlessly integrates into the development workflow, enhancing code safety, performance, and compliance.
Users appreciate several standout features of Semgrep Code. Its simplicity and ease of setup make it accessible to a wide range of developers. The tool's customization capabilities allow users to tailor rules to their specific needs, thus providing great flexibility. Its speed and efficiency in scanning code help maintain quick development cycles. Importantly, the tool's proficiency in identifying and mitigating security vulnerabilities significantly enhances codebase reliability.
Semgrep Code significantly enhances organizational efficiency by improving teamwork, accelerating workflows, and streamlining project management, thus fostering a more productive and organized work environment.
AppSec testing optimized for the needs of API developers
APIs provide open, flexible interfaces that enable applications and services to talk to each other. But these characteristics can also make it difficult to build secure software—and even more difficult for traditional AppSec tools to test it.
Legit Security provides application security posture management platform that secures application delivery from code to cloud and protects an organization's software supply chain from attack. The platform’s unified application security control plane and automated SDLC discovery and analysis capabilities provide visibility and security control over rapidly changing environments and allow security issues to be prioritized based on context and business criticality to improve security team efficiency and effectiveness.
The pricing is reasonable.
The pricing is reasonable.
Stop Attacks Across Your Software Supply Chain.
Automatically block risks introduced into the pipeline and ensure the integrity of each workload, all from a single location.
Chainguard is a robust solution designed to ensure the security and integrity of software supply chains. Users leverage it primarily for securing container images, automating security tasks throughout the development lifecycle, and maintaining compliance with industry standards. The platform excels in vulnerability management, providing vital visibility and control over software dependencies.
The standout feature of Chainguard is its emphasis on security and ease of use. Users consistently praise its robust supply chain security measures, which build confidence in the platform's safeguarding capabilities. The integration and automated processes significantly reduce setup and maintenance efforts, while the high level of support from the company ensures user needs are promptly addressed. Additionally, managed updates and operational transparency add to its reliability, ensuring environments are up-to-date without extra hassles.
Chainguard has notably boosted workflow efficiency, streamlined processes, and enhanced productivity across organizations. Its impact on collaboration and communication has been significant, resulting in better task management, timely project completions, and a more organized and cohesive team dynamic.