Software Application Security Testing (SAST) where Quality matters.

CodeSonar is CodeSecure’s award winning Static Application Security Testing (SAST) Tool. With CodeSonar software engineers deliver better code faster, especially where software security and software quality matters. This supports engineers to deliver new and innovative features faster and with higher quality. Further, CodeSonar supports engineers in meeting functional safety and coding standards with less effort.

Accelerating Software Application Security Testing –  find Vulnerabilities others Miss

CodeSonar is a static code analysis solution that helps you find and understand quality and security defects in your source code or binaries. CodeSonar makes it easy to integrate SAST into your development process.  Support for over 100 compilers and compiler versions is available with numerous integrations to popular development tools and IDEs. Therefore, CodeSonar makes integration into the DevSecOps and Continuous Integration process easy.

Bring Security into DevSecOps – at Speed and Scale

CodeSonar was doing DevSecOps before it was cool. Industries and companies are rapidly undergoing a digital transformation. Techniques like DevSecOps help companies respond to this challenge by releasing solutions to market faster and with fewer defects. Static code analysis is a fundamental component of DevSecOps.

Fulfill Functional Safety & Coding Standards – Quality with Safety and Security

SAST can help you achieve your functional safety objectives easier complying with coding standards like MISRA, AUTOSAR, JSF++, CWE, or CERT. Further, CodeSonar supports all major coding standards and is pre-qualified for the highest levels of safety for IEC 61508, ISO 26262, and EN 50128 standards. Artifacts for qualification according to DO-178C/DO-330 are also available.

Gain In-Development Insights – Beyond Simply “We think there’s a problem”

Go beyond just finding problems to a deep understanding of where a warning comes from and what the risks are, even in code you did not write. In addition, CodeSonar provides whole-program SAST along with unique inspection reporting capabilities, helping developers understand, prioritize, and remediate issues rapidly.

Supported Languages

CodeSonar supports many popular languages, including C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript, and TypeScript as well as support for native binaries in Intel, and ARM instruction set architectures.

OASIS SARIF to exchange information with other tools in the DevSecOps environment is also supported.

Meet Functional Safety Certifications

Given the increased use of software in mission-critical and safety-critical applications it’s critical that software follows standards that specify how developers should write code to increase its readability and reliability. CodeSonar automates both the detection and prevention of critical software defects. Some of the use cases include:

  • IEC 61508 – Functional Safety of Electric / Electrical / Programmable Electronic Safety-Related Systems
  • ISO 26262 (Automotive software) – Road Vehicles Functional Safety
  • DO 178C / DO 330 (Airborne systems) – Software Considerations in Airborne Systems and Equipment Certification / Software Tool Qualification Considerations
  • IEC 62443 (Industrial systems) – Security for Industrial Automation and Control Systems
  • IEC 62304 / ISO 13485 (Medical Devices) – Medical Device Software – Software Life Cycle Management / Medical Devices – Quality Management Systems. Requirements for Regulatory Purposes
  • EN 50128 (Railway systems) – Railway Applications. Communication, Signaling, and Processing Systems. Software for Railway Control and Protection Systems

Ensure Coding Standard Compliance and Enforcement

  • MISRA-C and MISRA-C++ (Motor Industry Software Reliability Association)
  • AUTOSAR C++ (Automotive Open System Architecture)
  • CERT (Software Engineering Institute Computer Emergency Response Team=
  • DISA STIG (Security Technical Implementation Guide)
  • ISO/IEC TS 17961 (C Secure Coding Rules Technical Specification)
  • OWASP (Open Worldwide Application Securtiy Project)
  • MITRE CWE (Common Weakness Enumeration)
  • JPL (JPL Institutional Coding Standard for the C Programming Language)
  • Power of Ten (NASA Jet Propulsion Lab)
  • JSF+ (Lockheed Martin Corporation)
  • others

Developer-friendly interface

  • IDE support for Eclipse, Microsoft Visual Studio & Visual Studio Code
  • Warnings reflected in source code
  • Clear explanations with path information
  • Whole program navigation and visualization

Seamlessly integrates into DevSecOps and CI/CD workflow

  • Automate continuous code analysis
  • Warning tracking with suppression
  • GitLab, GitHub, BitBucket and Jenkins integration

Customizable to meet specific requirements

  • Shift Left support promotes security by design
  • Higher quality and more secure code by detecting and remediating errors and vulnerabilities sooner

Customers about our services

ReqEdit – Supply Chain Solution

"Vow - this is awesome"


Procurement Engineer at an Industrial Mobility Company.

Bernina International AG

„Dank der Modelle können wir neue Funktionen und Abhängigkeiten visualisieren. Ein Bild sagt mehr als 1‘000 Worte und die grafisch modellierte Abstraktion macht uns Entwicklern das Leben sehr viel einfacher. Gleichzeitig nimmt uns die mit dem Modell verbundene Codegenerierung einen grossen Teil der Arbeit ab!“

Giovanni Annunzio

System Architect

Mettler Toledo AG

„Now the advantages of our solid foundation work will have a large impact. A model is easy to adapt and maintain and new functions can be integrated very fast. In combination with the automatic code generation and testing we now will be strikingly faster… with a consistent high quality. Today we save time and money – not least thanks to IBM Rational Rhapsody!"

Wolfgang Boos

Head of Software

Perforce Helix Customer sold to global leading company.

"Perforce Helix Core fully meets our expectations. We have a solution from one source on which we can rely."

Head of Product Development

Hamilton Medical AG – Rhapsody

„The direct coupling of design and code with Rhapsody helps us managing the complexity of our products more easily, as design and code remain consistent in the long term.“

Andreas Anderegg

Senior Software Engineer


A warm praise to the very motivated trainer. The training content is conveyed in a very enjoyable and entertaining way. It was also very good to review the respective training days at the end. Frank Braun was able to answer every question and also tried, as far as time allowed, to address further topics raised.


Systems Engineer

MCS Engineering AG

"It is very easy to set up and run a Perforce Helix Core proxy server for working with geographically dispersed teams. Downloading data is also very easy. We were amazed at how much time we saved."

Eric Gutmann

Project Leader

Bernina International AG

„Abstraktion, Simulation, Wiederverwendung und automatische Codegenerierung sind bei Bernina zentral für eine kurze Time-to-Market… und somit der Schlüssel zum Erfolg!“

Giovanni Annunzio

System Architect

Bernina International AG

„The architecture must be set up in the right way and in conformity with the requirements of model driven development – right from the beginning! I strongly recommend to seek for the support of an external, experienced Rhapsody specialist as for example supplied by EVOCEAN and to model the architecture together.“

Giovanni Annunzio

System Architect

Rhapsody User Group

Good experts present. Always interesting to meet other Rhapsody users.

Stefan Singler

Software Engineer