Software Application Security Testing (SAST) where Quality matters.

CodeSonar is CodeSecure’s award winning Static Application Security Testing (SAST) Tool. With CodeSonar software engineers deliver better code faster, especially where software security and software quality matters. This supports engineers to deliver new and innovative features faster and with higher quality. Further, CodeSonar supports engineers in meeting functional safety and coding standards with less effort.

Accelerating Software Application Security Testing –  find Vulnerabilities others Miss

CodeSonar is a static code analysis solution that helps you find and understand quality and security defects in your source code or binaries. CodeSonar makes it easy to integrate SAST into your development process.  Support for over 100 compilers and compiler versions is available with numerous integrations to popular development tools and IDEs. Therefore, CodeSonar makes integration into the DevSecOps and Continuous Integration process easy.

Bring Security into DevSecOps – at Speed and Scale

CodeSonar was doing DevSecOps before it was cool. Industries and companies are rapidly undergoing a digital transformation. Techniques like DevSecOps help companies respond to this challenge by releasing solutions to market faster and with fewer defects. Static code analysis is a fundamental component of DevSecOps.

Fulfill Functional Safety & Coding Standards – Quality with Safety and Security

SAST can help you achieve your functional safety objectives easier complying with coding standards like MISRA, AUTOSAR, JSF++, CWE, or CERT. Further, CodeSonar supports all major coding standards and is pre-qualified for the highest levels of safety for IEC 61508, ISO 26262, and EN 50128 standards. Artifacts for qualification according to DO-178C/DO-330 are also available.

Gain In-Development Insights – Beyond Simply “We think there’s a problem”

Go beyond just finding problems to a deep understanding of where a warning comes from and what the risks are, even in code you did not write. In addition, CodeSonar provides whole-program SAST along with unique inspection reporting capabilities, helping developers understand, prioritize, and remediate issues rapidly.

Supported Languages

CodeSonar supports many popular languages, including C/C++, Java, C#, Kotlin, Python, Go, Rust, JavaScript, and TypeScript as well as support for native binaries in Intel, and ARM instruction set architectures.

OASIS SARIF to exchange information with other tools in the DevSecOps environment is also supported.

Meet Functional Safety Certifications

Given the increased use of software in mission-critical and safety-critical applications it’s critical that software follows standards that specify how developers should write code to increase its readability and reliability. CodeSonar automates both the detection and prevention of critical software defects. Some of the use cases include:

  • IEC 61508 – Functional Safety of Electric / Electrical / Programmable Electronic Safety-Related Systems
  • ISO 26262 (Automotive software) – Road Vehicles Functional Safety
  • DO 178C / DO 330 (Airborne systems) – Software Considerations in Airborne Systems and Equipment Certification / Software Tool Qualification Considerations
  • IEC 62443 (Industrial systems) – Security for Industrial Automation and Control Systems
  • IEC 62304 / ISO 13485 (Medical Devices) – Medical Device Software – Software Life Cycle Management / Medical Devices – Quality Management Systems. Requirements for Regulatory Purposes
  • EN 50128 (Railway systems) – Railway Applications. Communication, Signaling, and Processing Systems. Software for Railway Control and Protection Systems

Ensure Coding Standard Compliance and Enforcement

  • MISRA-C and MISRA-C++ (Motor Industry Software Reliability Association)
  • AUTOSAR C++ (Automotive Open System Architecture)
  • CERT (Software Engineering Institute Computer Emergency Response Team=
  • DISA STIG (Security Technical Implementation Guide)
  • ISO/IEC TS 17961 (C Secure Coding Rules Technical Specification)
  • OWASP (Open Worldwide Application Securtiy Project)
  • MITRE CWE (Common Weakness Enumeration)
  • JPL (JPL Institutional Coding Standard for the C Programming Language)
  • Power of Ten (NASA Jet Propulsion Lab)
  • JSF+ (Lockheed Martin Corporation)
  • others

Developer-friendly interface

  • IDE support for Eclipse, Microsoft Visual Studio & Visual Studio Code
  • Warnings reflected in source code
  • Clear explanations with path information
  • Whole program navigation and visualization

Seamlessly integrates into DevSecOps and CI/CD workflow

  • Automate continuous code analysis
  • Warning tracking with suppression
  • GitLab, GitHub, BitBucket and Jenkins integration

Customizable to meet specific requirements

  • Shift Left support promotes security by design
  • Higher quality and more secure code by detecting and remediating errors and vulnerabilities sooner

Customers about our services

Bernina Internation AG

„Früher haben wir pro Jahr ein neues Produktmodell lanciert – heute sind es mehrere dank Wiederverwendung von Modulen, welches auch unser Testaufwand markant reduziert hat.“

Giovanni Annunzio

System Architect

Perforce Helix Customer sold to global leading company.

"Perforce Helix Core fully meets our expectations. We have a solution from one source on which we can rely."

Head of Product Development

soplar s.a.

„We would repeat our decision to choose Rhapsody® at any time. The strikingly improved efficiency, higher quality, and flexibility plus reusability of models make any adverse details negligible. Today we develop more machines with fewer resources in less time."

Reinhold Wüstner

Head of Product Development

Mettler Toledo AG

„I would recommend Rhapsody anytime – by using Rhapsody I can reach a new level of programming and efficiency.“

Wolfgang Boos

Head Software Development


A warm praise to the very motivated trainer. The training content is conveyed in a very enjoyable and entertaining way. It was also very good to review the respective training days at the end. Frank Braun was able to answer every question and also tried, as far as time allowed, to address further topics raised.


Systems Engineer


"Ein grosses Lob an den sehr motivierten Trainer. Der Trainingsinhalt wird sehr kurzweilig und auch unterhaltsam vermittelt. Methodisch sehr gut war auch die jeweiligen Trainingstage am Ende nochmals Revue passieren zu lassen. Frank Braun konnte auch jede Frage beantworten und hat auch versucht, sofern der zeitliche Rahmes es erlaubte, auf angesprochenen Themen einzugehen."


Systems Engineer

Phonak Communication AG

„Model Driven Development with Rational Rhapsody® was a critical success factor for developing inspiro within the required schedule and market needs. Thanks to EVOCEAN's support, we were able to implement the tool quickly and apply the methodology effectively."

Rainer Platz

Head of R&D

Bernina International AG

„For Bernina, abstraction, simulation, reuse and automatic code generation are central for a short time-to-market … and therefore the key of our success!"

Giovanni Annunzio

System Architect

Rhapsody User Group

Good experts present. Always interesting to meet other Rhapsody users.

Stefan Singler

Software Engineer

soplar s.a. – Training

„Starting to use Rational Rhapsody®without coaching or training is not recommended. Understanding the why behind certain processes is essential to working effectively. Training with EVOCEAN was very valuable for me in this regard."

Vitali Mozgovoi

Software Developer