CodeSonar

Software Application Security Testing (SAST) where Quality matters.

CodeSonar is CodeSecure’s award winning Static Application Security Testing (SAST) Tool. With CodeSonar software engineers deliver better code faster, especially where software security and software quality matters. This supports engineers to deliver new and innovative features faster and with higher quality. Further, CodeSonar supports engineers in meeting functional safety and coding standards with less effort.

Accelerating Software Application Security Testing –  find Vulnerabilities others Miss

CodeSonar is a static code analysis solution that helps you find and understand quality and security defects in your source code or binaries. CodeSonar makes it easy to integrate SAST into your development process.  Support for over 100 compilers and compiler versions is available with numerous integrations to popular development tools and IDEs. Therefore, CodeSonar makes integration into the DevSecOps and Continuous Integration process easy.

Bring Security into DevSecOps – at Speed and Scale

CodeSonar was doing DevSecOps before it was cool. Industries and companies are rapidly undergoing a digital transformation. Techniques like DevSecOps help companies respond to this challenge by releasing solutions to market faster and with fewer defects. Static code analysis is a fundamental component of DevSecOps.

Fulfill Functional Safety & Coding Standards – Quality with Safety and Security

SAST can help you achieve your functional safety objectives easier complying with coding standards like MISRA, AUTOSAR, JSF++, CWE, or CERT. Further, CodeSonar supports all major coding standards and is pre-qualified for the highest levels of safety for IEC 61508, ISO 26262, and EN 50128 standards. Artifacts for qualification according to DO-178C/DO-330 are also available.

Gain In-Development Insights – Beyond Simply “We think there’s a problem”

Go beyond just finding problems to a deep understanding of where a warning comes from and what the risks are, even in code you did not write. In addition, CodeSonar provides whole-program SAST along with unique inspection reporting capabilities, helping developers understand, prioritize, and remediate issues rapidly.

Supported Languages

CodeSonar supports many popular languages, including C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript, and TypeScript as well as support for native binaries in Intel, and ARM instruction set architectures.

OASIS SARIF to exchange information with other tools in the DevSecOps environment is also supported.

Meet Functional Safety Certifications

Given the increased use of software in mission-critical and safety-critical applications it’s critical that software follows standards that specify how developers should write code to increase its readability and reliability. CodeSonar automates both the detection and prevention of critical software defects. Some of the use cases include:

• IEC 61508 – Functional Safety of Electric / Electrical / Programmable Electronic Safety-Related Systems
• ISO 26262 (Automotive software) – Road Vehicles Functional Safety
• DO 178C / DO 330 (Airborne systems) – Software Considerations in Airborne Systems and Equipment Certification / Software Tool Qualification Considerations
• IEC 62443 (Industrial systems) – Security for Industrial Automation and Control Systems
• IEC 62304 / ISO 13485 (Medical Devices) – Medical Device Software – Software Life Cycle Management / Medical Devices – Quality Management Systems. Requirements for Regulatory Purposes
• EN 50128 (Railway systems) – Railway Applications. Communication, Signaling, and Processing Systems. Software for Railway Control and Protection Systems

Ensure Coding Standard Compliance and Enforcement

• MISRA-C and MISRA-C++ (Motor Industry Software Reliability Association)
• AUTOSAR C++ (Automotive Open System Architecture)
• CERT (Software Engineering Institute Computer Emergency Response Team=
• DISA STIG (Security Technical Implementation Guide)
• ISO/IEC TS 17961 (C Secure Coding Rules Technical Specification)
• OWASP (Open Worldwide Application Securtiy Project)
• MITRE CWE (Common Weakness Enumeration)
• JPL (JPL Institutional Coding Standard for the C Programming Language)
• Power of Ten (NASA Jet Propulsion Lab)
• JSF+ (Lockheed Martin Corporation)
• others

Developer-friendly interface

• IDE support for Eclipse, Microsoft Visual Studio & Visual Studio Code
• Warnings reflected in source code
• Clear explanations with path information
• Whole program navigation and visualization

Seamlessly integrates into DevSecOps and CI/CD workflow

• Automate continuous code analysis
• Warning tracking with suppression
• GitLab, GitHub, BitBucket and Jenkins integration

Customizable to meet specific requirements

• Shift Left support promotes security by design
• Higher quality and more secure code by detecting and remediating errors and vulnerabilities sooner