CodeSonar

What CodeSonar is

CodeSonar is a static application security testing solution for finding security and quality defects in source code and compiled binaries. It supports C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript, and TypeScript. Its analysis uses abstract interpretation and symbolic execution to explore feasible execution paths across procedures and modules. Binary analysis can cover mixed-language environments and cases where source code is unavailable.

Security coverage includes OWASP Top 10, SANS/CWE 25, SEI CERT C/C++, and DISA STIG. Supported coding standards include MISRA-C, MISRA-C++, AUTOSAR C++, JSF++, and CERT. CodeSonar integrates with developer IDEs, project management, and CI/CD workflows; named integrations include Visual Studio, GitLab, Jira, Jenkins, and VS Code. Pull request scans and custom security rules are supported. A custom report builder exports PDF, HTML, or XML.

AdaCore offers a trial to evaluate CodeSonar in a customer’s environment. Deployment options include on-premises and air-gapped environments, developer workstations, DevOps pipelines, and private clouds. Pricing is available on request, with flexible licensing based on usage size, team needs, and deployment configuration.

Who it suits

CodeSonar suits development and security teams looking to find code defects across source and compiled binaries, including mixed-language projects. It also fits teams that need CI/CD or IDE integration, supported coding standards, or deployment in on-premises and air-gapped environments.

Getting started

1. Visit the CodeSonar product page.
2. Request a trial to evaluate the product in your environment.
3. Contact AdaCore for pricing and licensing based on usage, team needs, and deployment configuration.
4. Select a supported 64-bit Windows version or 64-bit Linux distribution with glibc 2.39 or higher.
5. Choose an installation environment, such as on premises, an air-gapped environment, a developer workstation, a DevOps pipeline, or a private cloud.
6. Connect CodeSonar with the relevant IDE, project management, or CI/CD workflow.

Verdict

Choose CodeSonar if you need static analysis across source code and binaries, with support for named security coverage, coding standards, and deployment options. Consider another option if you need a published price before contacting the vendor or cannot meet the stated operating system requirements.