CodeSonar
6.0#13 in static application security testing sastWebLinuxSelf-hostedWindows
VisitCodeSonar vs Semgrep Code
Semgrep Code
8.3#1 in sast toolsFrom $15 a monthFree planWebAPIExtensionLinux
VisitWhat both publish
| Fact | CodeSonar | Semgrep Code |
|---|---|---|
| Founded | 1994 | 2017 |
| Headquarters | New York, United States and Paris, France | San Francisco, California, United States |
| Integrations | The product page identifies Visual Studio, GitLab, Jira, Jenkins, and VS Code integrations, and says CodeSonar integrates with project management, CI/CD workflows, and developer IDEs. | Supported workflow connections include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, Buildkite, HackerOne, Slack, email, webhooks, VS Code and IntelliJ. |
| Languages | It supports C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript, and TypeScript. | Semgrep lists support for more than 30 programming languages and frameworks for SAST and nine for SCA. |
| Purpose | CodeSonar is a static application security testing solution that finds security and quality defects in code. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
CodeSonar plans
- CodeSonarPriced on request
Semgrep Code plans
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
Pick CodeSonar if…
CodeSonar may suit teams seeking static security and quality analysis across supported languages, including projects that need binary analysis or specific coding standards. Its deployment options include on-premises and air-gapped environments.
Pick Semgrep Code if…
Semgrep Code suits development teams looking for source-code vulnerability scanning within pull request, IDE or CI workflows. The listed Free Edition is for teams within its repository and contributor limits; larger teams can consider the paid tiers.