Qodana                  GHAS/CodeQL                     SemGrep                                     SonarQube

Code analysis
Languages Java, python, js java, python, js, c# Infrastucture
Go Docker, k8s, nginx, AWS, Terraform Pre commit
Jetbrains Y N Y VS Code N CodeQL Y cli/docker Y N N commit trigger N GithubAction
Jenkins AzureDevops Source control GithubAction
Jenkins AzureDevops pr, schedule GithubAction Y Y AzureDevops Y N Jenkins Y via Sarif*
SonarQube Sarif

SCA
SAST DAST

results Findings Comprehensive Comprehensive Untested ? Format Sarif Sarif
// Community - Strong Y False positives

Issues Still EAP No C# support

POCs Links

Maturity EAP
Community

Organisation Overview Audit Licence Pricing model

Evaluation Does it support programming languages my company uses? Is it easy to hook into my CI systems? (Github actions. Gitlab, CircleCI, Jenkins, Azure DO AWS CodePipeline etc) Am I going to have to manage a server that runs the tool? Will I have to share access to source code? Is it easy to extend/customize to my environment?

SCA Software Composition Analysis (SCA) is verification of the third-party libraries, frameworks and components used within your application; all of the code that you and your team did not write is considered by SCA tools.

SAST SAST (Static Application Security Testing) is the automated analysis of written code (compiled or uncompiled) for security vulnerabilities.

SpectralOps Veracode

	Qodana	GHAS/CodeQL	SonarQube
Code analysis languages	Java, python, js