静的解析 - kocya-dev/note GitHub Wiki
Codacy / GHAS CodeQL / Snyk
- 言語サポート
- PRチェック、CI/CD組み込みの手間、閲覧性
- Secrets scanningのような機能の代替手段
https://sourceforge.net/software/compare/Codacy-vs-CodeSonar-vs-Snyk/
| Codacy | Snyk | CodeSonar | GitHub Advanced Security | --- | ||
|---|---|---|---|---|---|---|
| 言語 | 〇 | 〇 | △ | 大差なし | ||
| IaC | 〇 | 〇 | - | Cloud Formation/Terraform/Kubernetes | ||
| 規格 | IEC 61508 (機能安全) | - | - | 〇 | - | 他にはC/C++testなど |
| ISO 26262 (機能安全) | - | - | 〇 | - | 他にはC/C++testなど | |
| CENELEC EN 50128(ソフトウェア安全) | - | - | 〇 | - | 他にはVisure など | |
| ISO/SAE 21434 (自動車、リスク管理) | - | - | 〇 | - | ||
| DO 178C / DO-330 (機能安全 開発保証レベル) | - | - | 〇 | - | ||
| 連携 | GitHub | 〇 | 〇 | 〇 | ||
| IDE | VSCode | 〇 | 〇 | 〇 | - | |
| VS | - | 〇 | 〇 | - | - | |
| InteliJ | 〇 | 〇 | - | - | ||
| Eclipse | - | 〇 | 〇 | - | ||
| 機能 | AI Code Review | 〇 | 〇 | - | - | |
| AI Coding Assistants | 〇 | - | - | - | ||
| AI Tools | 〇 | - | - | - | ||
| Application Security | - | - | - | 〇 | ||
| Automated Testing | 〇 | - | - | - | ||
| Code Coverage | 〇 | - | - | - | ||
| Code Review | 〇 | - | - | - | ||
| Cloud Security Posture Management (CSPM) | 〇 | 〇 | - | - | ||
| Container Security | - | 〇 | - | - | ||
| Cybersecurity | - | 〇 | - | - | ||
| DORA Metrics | 〇 | - | - | - | ||
| Dynamic Application Security Testing (DAST) | 〇 | - | - | - | ||
| IT Security | - | 〇 | - | - | ||
| Network Security | - | 〇 | - | - | ||
| Software Bill of Materials (SBOM) | - | 〇 | - | 〇 | ||
| Software Composition Analysis (SCA) | - | 〇 | - | - | ||
| Software Development Analytics | 〇 | - | - | - | ||
| Static Application Security Testing (SAST) | - | 〇 | 〇 | 〇 | ||
| Static Code Analysis | 〇 | 〇 | 〇 | 〇 | ||
| Vulnerability Management | - | 〇 | - | - | ||
| Vulnerability Scanners | - | 〇 | - | - | ||
| 静的解析 | Analytics / Reporting | 〇 | 〇 | - | ||
| Code Standardization / Validation | 〇 | - | - | |||
| Multiple Programming Language Support | 〇 | 〇 | - | |||
| Provides Recommendations | 〇 | - | - | |||
| Standard Security/Industry Libraries | 〇 | - | - | |||
| Vulnerability Management | 〇 | 〇 | - |