Black Duck Coverity vs Semgrep Code
| Black Duck Coverity | Semgrep Code | |
|---|---|---|
| Free plan | Yes | |
| Paid from | $30/mo | |
| Platforms | Linux, macOS, self-hosted, Web, Windows | api, extension, Linux, macOS, self-hosted, Web, Windows |
| IDE support | Yes | Yes |
| CI/CD support | Yes | |
| Free plan | No | No |
| Analysis targets | source code | source code |
| Pull request scans | Yes | Yes |
| CI/CD integration | Yes | Yes |
| Custom security rules | Yes | Yes |
| Automated fixes | Yes | Yes |
| Analysis target | source | |
| Deployment | self-hosted | |
| Fix guidance | Yes | |
| Paid from | 15 /user/mo | |
| Custom rules | Yes | |
| Deployment model | cloud | |
| IaC scanning | Yes | |
| Container scanning | Yes | |
| Policy as code | Yes | |
| Remediation workflows | Yes | |
| SBOM management | Yes | |
| Languages supported | 35 | |
| Supported VCS | GitHub, GitLab, Bitbucket, Azure DevOps | |
| CI/CD scanning | Yes | |
| Pre-commit scanning | Yes | |
| Pull-request scanning | Yes | |
| Custom detection rules | Yes | |
| Repository limit | 500 repositories |
Listed together in Best Static Analysis ToolsBest SAST ToolsBest Static Application Security Testing Software