SonarQube add-on extending SAST and SCA to detect CVEs, malicious packages, and license risks with SBOM export.
SonarQube Advanced Security is an enterprise extension of the SonarQube platform that adds software composition analysis and advanced SAST to core quality and security analysis. It identifies known vulnerabilities in direct and transitive open source dependencies, prioritizing them by severity and exploitability, and detects malicious packages entering the CI/CD pipeline.
The add-on provides automated license detection and policy enforcement, software bill of materials export in CycloneDX and SPDX formats, and dependency-aware taint analysis that traces data flow across third-party libraries for Java and C#. Findings integrate into the SonarQube workflow with security reporting for standards including OWASP, CWE, and PCI DSS.
Codacy
Codacy - Code Quality and Security Platform
codacy.com
GitHub
GitHub Advanced Security
github.com
Semgrep
Semgrep Code
semgrep.dev
Snyk
Snyk Code
snyk.io
| Attribute | SonarQube Advanced Security | Codacy - Code Quality and Security Platform | GitHub Advanced Security | Semgrep Code | Snyk Code | |
|---|---|---|---|---|---|---|
| Provider | | | | | | |
| Founded | 2008 | 2012 | 2008 | 2017 | 2015 | |
| Sells To | Enterprise, Software Developers | Developer | Enterprise | Enterprise | Enterprise | |
| Pricing Model | B2B Subscription, Freemium | B2B Subscription, Subscription | Recurring, Software, Usage-based | Recurring, SaaS | Recurring, Software | |
| Ownership | Private, Venture-backed | Private | Subsidiary | Private equity-backed, Venture-backed | Venture-backed |
Provider
Founded 2008
Sells To Enterprise, Software Developers
Pricing Model B2B Subscription, Freemium
Ownership Private, Venture-backed
Provider
Founded 2012
Sells To Developer
Pricing Model B2B Subscription, Subscription
Ownership Private
Provider
Founded 2008
Sells To Enterprise
Pricing Model Recurring, Software, Usage-based
Ownership Subsidiary
Provider
Founded 2017
Sells To Enterprise
Pricing Model Recurring, SaaS
Ownership Private equity-backed, Venture-backed
Provider
Founded 2015
Sells To Enterprise
Pricing Model Recurring, Software
Ownership Venture-backed
Developer-security platform that finds and fixes vulnerabilities in open-source dependencies, containers, and infrastructure as code.
Platform generating SBOMs and scanning containers for software supply chain security.
Multi-disciplinary security reviews across application, blockchain, cryptography, and AI systems.
DevOps platform for artifact management, SBOM generation, vulnerability scanning, and software supply-chain security.
Repo-aware agents that prioritize real risk and generate exact fixes.
Snyk Agent Fix automatically generates code fixes for vulnerabilities Snyk identifies in application code.
AI-powered security analysis tool that scans codebases for vulnerabilities and proposes targeted patches
Automated DAST scanner for web applications and APIs with CI/CD integration.
Developer-security platform that finds and fixes vulnerabilities in open-source dependencies, containers, and infrastructure as code.
Platform generating SBOMs and scanning containers for software supply chain security.
Multi-disciplinary security reviews across application, blockchain, cryptography, and AI systems.
DevOps platform for artifact management, SBOM generation, vulnerability scanning, and software supply-chain security.
Repo-aware agents that prioritize real risk and generate exact fixes.
Qodana is the JetBrains static code analysis platform for code quality, security scanning, and engineering metrics.
Cloud security posture frameworks with CIS, SOC 2, NIST, and PCI-DSS coverage.
Free real-time enforcement of security and quality standards.
Snyk Agent Fix automatically generates code fixes for vulnerabilities Snyk identifies in application code.
AI-powered security analysis tool that scans codebases for vulnerabilities and proposes targeted patches
Automated DAST scanner for web applications and APIs with CI/CD integration.
