Black Duck Coverity vs Codacy

Black Duck Coverity is a paid static analysis solution for finding security vulnerabilities and code quality defects in source code before software ships. It analyzes code without executing it, scanning across files and libraries in entire codebases. Black Duck lists support for 22 programming languages and more than 250 frameworks, along with standards including MISRA, AUTOSAR, ISO 26262, PCI DSS, CERT C/C++/Java, DISA STIG, OWASP Top 10, and CWE Top 25. Coverity is TÜV SÜD certified for IEC 61508-3 support-tool requirements and qualified for use up to ASIL D under ISO 26262 and Level A under DO-178C. The Code Sight IDE plug-in offers real-time results, issue summaries, and code fixes. IDE, SCM, and CI integrations can trigger scans on commits and pull requests; listed connections include GitHub, GitLab, Bitbucket, Azure DevOps, Jenkins, and others. Deployment can be fully air-gapped on premises, including Kubernetes clusters. Pricing is customized to team size and codebase and supplied by quote.

Codacy is a cloud platform for engineering teams focused on code quality, security, and AI coding standards. Its AI Reviewer reviews pull requests with fix suggestions and summaries, and can identify false positives automatically. Listed security capabilities include SAST, software composition analysis, secret scanning, infrastructure-as-code scanning, DAST, and container image scanning. Team offers shared coding standards across 49 languages, integrations for GitHub, Bitbucket, GitLab, Jira, and Slack, and capacity for up to 30 developers and 100 private repositories with unlimited lines of code. Developer includes an IDE plugin and integrations for VSCode, JetBrains, and Cursor; the IDE extension comparison also names Windsurf. Developer costs nothing. Team costs $18 a year with yearly billing or $21 a month with monthly billing, billed per developer per month. A 14-day free trial is available without a credit card. Codacy states that it is GDPR compliant and has SOC 2 Type II compliance; its services run on AWS, with data in transit encrypted using TLS.