Black Duck Coverity vs ClusterFuzz

Black Duck Coverity is a paid static analysis solution for finding security vulnerabilities and code quality defects in source code before software ships. It analyzes code without executing it, scanning across files and libraries in entire codebases. Black Duck lists support for 22 programming languages and more than 250 frameworks, along with standards including MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, OWASP Top 10, and CWE Top 25. Coverity is TÜV SÜD certified for IEC 61508-3 support-tool requirements and qualified for use up to ASIL D under ISO 26262 and Level A under DO-178C. The Code Sight IDE plug-in offers real-time results, issue summaries, and code fixes. IDE, SCM, and CI integrations can trigger scans on commits and pull requests; listed connections include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, and others. Deployment can be fully air-gapped on premises, including Kubernetes clusters. Pricing is customized to team size and codebase and supplied by quote.

ClusterFuzz is open-source infrastructure for finding security and stability problems in software through fuzzing. It supports coverage-guided engines libFuzzer, AFL++, and Honggfuzz, alongside blackbox fuzzing. Its workflow can find crashes, group duplicates, minimize testcases, use bisection to locate regressions, and verify fixes. It can also file, triage, and close bugs automatically. Google uses ClusterFuzz across its products and as the fuzzing backend for OSS-Fuzz. The system is designed to run on clusters of any size; Google’s instance runs on 30,000 VMs. Production deployments use Google Cloud services, including App Engine, Cloud Storage, Cloud Datastore, Cloud Pub/Sub, BigQuery, and Stackdriver Logging and Monitoring. Local instances are supported on Linux and macOS, with some BigQuery- and Stackdriver-dependent features disabled. Although the overview mentions Monorail and Jira as examples, the architecture currently supports only Chromium-hosted Monorail. The software runs on Linux, macOS, and Windows and is licensed under Apache-2.0. Its listed price is free.