About CodeSonar
CodeSonar is a Static Application Security Testing (SAST) tool for C/C++, Java, C#, Go, Python, and other languages. It performs deep, whole-program static analysis to find bugs, security vulnerabilities, and compliance violations before testing.
CodeSonar, offered by AdaCore, is a static application security testing (SAST) solution designed for high-integrity software projects in industries like aerospace, automotive, and defense. It performs deep semantic analysis on a wide range of languages, including C/C++, Java, Python, and Rust, to identify complex bugs and security vulnerabilities early in the development cycle. The tool integrates into existing CI/CD pipelines and IDEs, providing actionable feedback to developers. Key features include support for numerous coding standards (MISRA, CERT, CWE), advanced error detection through symbolic execution, and a centralized hub for reviewing analysis history. Pricing is available upon request, and support is provided directly by AdaCore's engineering team. The product is deployable on-premise, suiting air-gapped and secure environments.
Pros & Cons
- Native support for OASIS SARIF allows clean integration with modern enterprise CI/CD platforms.
- Performs whole-program analysis to catch complex multi-threaded and memory defects that surface across functions.
- Can scan compiled binary files (x86/ARM) without needing access to underlying source code.
- Setting up custom security checks or tuning false positives requires time and specialized domain knowledge.
- High subscription pricing targets large safety-critical enterprises rather than individual developers or small startups.
- Feature-rich interface requires dedicated onboarding for non-embedded or junior development teams.
Features
Key features
Analyzes C/C++, Java, C#, Go, Python, JavaScript, TypeScript, Kotlin, and Rust.
Uses abstract interpretation and symbolic execution to explore all feasible execution paths and detect defects across modules.
Supports coding standards such as MISRA C/C++, CERT-C, AUTOSAR C++, and CWE.
Integrates with IDEs and CI/CD pipelines to present defects like compiler warnings within existing workflows.
Provides a central repository to view and manage the full history of analyses, with visualizations for warning paths and call trees.
Additional features
Includes control flow, data flow, taint, and memory modeling to uncover subtle errors.
Compatible with a wide range of compilers including clang, GCC, GNAT Pro, Microsoft, IAR, TASKING, Green Hills, and Wind River.
Tracks defects across analyses, even if the code's location changes within a file.
Assesses risk in large, legacy codebases and third-party software integrations.
Pricing
Countries & Languages
Interface languages
Billing currencies
No reviews yet
Be the first to drop a review
Alternatives to CodeSonar
Squore
Squore is a software analytics and quality management platform from Vector. It enables organizations to…
Metabob
Metabob is a real-time, intelligent code analysis engine that runs in parallel with generative AI…
Spot something wrong or outdated?
Suggest a correction — a reviewer verifies every change.
About CodeSonar
CodeSonar is a Static Application Security Testing (SAST) tool for C/C++, Java, C#, Go, Python, and other languages. It performs deep, whole-program static analysis to find bugs, security vulnerabilities, and compliance violations before testing.
CodeSonar Details
CodeSonar's In-App Market Place
Does CodeSonar have an in-app market place?
Yes
How many Mini-Apps in the marketplace?
0
Mini Apps
Pricing Options
Accepted Payment Currencies
USD, EUR, GBP
Pros & Cons
- Native support for OASIS SARIF allows clean integration with modern enterprise CI/CD platforms.
- Performs whole-program analysis to catch complex multi-threaded and memory defects that surface across functions.
- Can scan compiled binary files (x86/ARM) without needing access to underlying source code.
- Setting up custom security checks or tuning false positives requires time and specialized domain knowledge.
- High subscription pricing targets large safety-critical enterprises rather than individual developers or small startups.
- Feature-rich interface requires dedicated onboarding for non-embedded or junior development teams.
CodeSonar's Support Options
Documentation
https://www.adacore.com/documentationCommunity Forums
https://www.adacore.com/communityCodeSonar's Alternatives
Squore
Squore is a software analytics and quality management platform from Vector. It enables organizations to…
Metabob
Metabob is a real-time, intelligent code analysis engine that runs in parallel with generative AI…
