CodeSonar vs DerScanner
CodeSonar
adacore.com
DerScanner
derscanner.comSide by side
| Figure | CodeSonar | DerScanner |
|---|---|---|
| Price from | — | — |
| Free plan | — | — |
| Free trial | Yes | — |
| Open source | — | — |
| Web | Yes | Yes |
| Windows | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 1 |
| Spec score · SAST Tools | 8.1 (#8) | 7.6 (#17) |
| Spec score · Application Security Testing | 8.0 (#10) | 7.5 (#15) |
| Deployment | AdaCore says its tools can be installed on premises or in air-gapped environments, including on developer workstations, DevOps pipelines, and private clouds. | The platform is offered in cloud or on-premise deployments, including air-gapped environments. |
| Founded | 1994 | 2011 |
| Integrations | The product page identifies Visual Studio, GitLab, Jira, Jenkins, and VS Code integrations, and says CodeSonar integrates with project management, CI/CD workflows, and developer IDEs. | The documentation says repository integrations support GitHub, GitLab, and Bitbucket through webhooks. |
| Maker | AdaCore says it began in 1994 as an Ada compiler company focused on Unix systems. | The maker says DerSecur has led application-security innovation since 2011 and that its code-analysis technologies originated at a research institute. |
| Support | AdaCore says its engineering team is directly accessible through support and that customers can speak with the developers of the technology. | The site invites prospective customers to request a demo, start a proof of concept, or request a tailored quote, and says its team can assist with on-premise setup. |
Plans
In their own words
CodeSonar
CodeSonar is AdaCore’s static application security testing solution for finding security and quality defects in source code and compiled binaries. It supports C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript and TypeScript. Abstract interpretation and symbolic execution examine feasible execution paths across procedures and modules. Binary analysis covers mixed-language environments and cases where source is unavailable. Security coverage includes OWASP Top 10, SANS/CWE 25, SEI CERT C/C++ and DISA STIG; coding standards include MISRA-C, MISRA-C++, AUTOSAR C++, JSF++ and CERT. Integrations include Visual Studio, GitLab, Jira, Jenkins and VS Code, alongside project-management, CI/CD and IDE workflows. Pull-request scans, custom security rules and report exports to PDF, HTML or XML are supported. AdaCore offers on-premises, air-gapped and private-cloud deployment. The tool runs on supported 64-bit Windows and Linux distributions with glibc 2.39 or higher. Pricing is on request, with a trial available.
DerScanner
DerScanner has no write-up on Specifiction yet; its figures are above.