Atlassian Jira vs. SonarQube vs. Veracode

Jira facilitates software development, bug tracking, and sprints. It's ideal for structured workflows, issue management, and customer communication. However, more straightforward tools might be more efficient for highly creative, unstructured tasks or tiny, agile teams with quick visual overviews. Jira's complexity can be overkill for basic task lists.

Incentivized

SonarQube is excellent if you start using it at the beginning when developing a new system, in this situation you will be able to fix things before they become spread and expensive to correct. It’s a bit less suitable to use on existing code with bad design as it’s usually too expensive to fix everything and only allows you to ensure the situation doesn’t get worse.

Incentivized

Veracode is well suited for development applications that can be made more secure right from the beginning. There is an excellent extension in Visual Studio that scans code from the IDE. However, it is less appropriate or incompatible with scanning SOAP or WSDL APIs. It supports only REST APIs.

Incentivized

• Integration of tools like Bitbucket, Github, etc., has made it easier to track the code changes, pull requests, and branches linked to the respective ticket.
• The detailed tracking system in JIRA has helped the teams prioritize and understand the project tasks and issues.
• JIRA's project tracking board helps you keep track of the project, its flow, and expectations in a structured format.

Incentivized

• Detecting bugs and vulnerabilities: SonarQube can identify a wide range of bugs and vulnerabilities in code, such as null pointer exceptions, SQL injection, and cross-site scripting (XSS) attacks. It uses static analysis to analyze the code and identify potential issues, and it can also integrate with dynamic analysis tools to provide even more detailed analysis.
• Measuring code quality: SonarQube can measure a wide range of code quality metrics, such as cyclomatic complexity, duplicated code, and code coverage. This can help teams understand the quality of their code and identify areas that need improvement.
• Providing actionable insights: SonarQube provides detailed information about issues in the code, including the file and line number where the issue occurs and the severity of the issue. This makes it easy for developers to understand and address issues in the code.
• Integrating with other tools: SonarQube can be integrated with a wide range of development tools and programming languages, such as Git, Maven, and Java. This allows teams to use SonarQube in their existing development workflow and take advantage of its powerful code analysis capabilities.
• Managing technical debt: SonarQube provides metrics and insights on the technical debt on the codebase, enabling teams to better prioritize issues to improve the quality of the code.
• Compliance with coding standards: SonarQube can check the code against industry standards like OWASP, CWE and more, making sure the code is compliant with security and coding standards.

Incentivized

• Veracode performs Static Application Security Testing (SAST) very well by finding flaws in the code using entry points so that it tests for everything a user can interact with in the application. This approach is very helpful for avoiding a lot of false positives early on.
• Veracode performs SCA automatically on every SAST scan, so that we don't have to manually scan the application again for SCA scans.
• Veracode integrates very well with the ticketing tools, so that it becomes very easy to track every finding and its status within our ticketing tool.

Incentivized

• The interface is not intuitive to learn for new users
• JQL is similarly challenging for newbies
• It's possible to accidentally move issues from one sprint to another without realizing your mistake
• Certain issue attributes aren't available in certain view (e.g. story points from the epic overview)

Incentivized

• Importing a new custom quality profile on SonarQube is a bit tricky, it can be made easier
• Every second time when we want to rerun the server, we have to restart the whole system, otherwise, the server stops and closes automatically
• When we generate a new report a second time and try to access the report, it shows details of the old report only and takes a lot of time to get updated with the details of the new and fresh report generated

Incentivized

• Scan results stability: from one scan to another, additional flaws appear whereas code did not change.
• Entry points selection: hard to be sure selection is optimal, should be automatized or hidden.
• Branches management: we currently use sandboxes to scan different branches of our software. Would be good to have real branches management.

Incentivized

This is because Jira Software generates a huge profit for an affordable price. Having a tool that makes team management transparent and effective is very valuable.

In addition, the renewal of Jira Software and all Atlassian tools is predictable and clear, as the prices are published on the Atlassian website and there is no pyramid of intermediaries.

Incentivized

At this time, and we just renewed a month ago, I dont see any products out there overall that can offer what Veracode does. Yes, its not cheap by any means, but for the money its the best application security scanning tool out there.

Incentivized

The interface is simple and easy to use if you have some experience with it. Configuration is also logical most of the time. However, less experienced users tend to find themselves lost in some tasks - usually complex project configuration- but sometimes simple things, such as seeing why a user can't move issues in a workflow. Jira configuration requires a good amount of experience - and even experienced users often resort to documentation. It's a tool that's easy to use if you know what you're doing and where to find the proper documentation, but novice users tend to find it challenging.

Incentivized

It can improve in some user experience and usability parts, like the code view and the way we assign issues it's a bit hidden and not highlighted

Incentivized

- Almost no setup required and easy to configure - Very easy to use, intuitive UI with integrated analytics and learning portals. - Seamless to review the results, triage them, generate reports. - Security progression of the product/application is tracked via successive scans. - Privileges/Roles nicely fine grained and tightly controlled to let teams "view" only their products.

Incentivized

Did not face any issues and whenever they plan maintanance they update all of us very well in advance also so in that view we are good with the product stability.

Incentivized

Veracode has always been up and available to us.

Incentivized

Performance is really good though it holds lot of data it loads quickly especially search operation also get the results very quickly as needed hence its good

Incentivized

At this point, it runs well and mostly in a timely fashion. Dynamic scans take days but this may be a config issue still to be resolved.

Incentivized

I have not had a chance to contact JIRA's customer support. It does offer extensive documentation, although it often feels too technical for me. There is also a JIRA training app that lets you take little lessons and quizzes on different areas (e.g., JIRA basics, agile). I did find it a helpful way to teach myself.

Incentivized

We we easily able to integrate the SonarQube steps into our TFS process via the Microsoft Marektplace, we didn't have the need to call SonarQube support. We've used their online documentation and community forum if we ran into any issues.

Incentivized

Overall, Veracode support is helpful, community support is great, and documentation is available for self-service. Our Customer Success Manager is very helpful and reaches out regularly to see if we need assistance. We have not utilized many of the other resources offered by Veracode, however, in the future we would like to leverage secure coding training for our Development teams.

Incentivized

Had received training from our own internal user so it was good and also very easy to understand topics and many tasks in the UI are self explanatory and we can do by our own

Incentivized

One of their strong points i stheir documentation. Almost all of the basic set up needed within JIRA is available online through atlassian and its easy to find and very precise. The more critical issues need to be addressed as well and hence the rating of 8 instead of a 9.

Incentivized

Take your time implementing Jira. Make sure you understand how you want to handle your projects and workflows. Investing more time in the implementation can pay off in a long run. It basically took us 5 days to define and implement correctly, but that meant smooth sailing later on.

Incentivized

We use it as a SAS service, so really just getting our teams to mold the use of Veracode into their SDLC has been a process of years in the making. It comes down to what your teams are ready and willing to accept and change. Management is key in getting their groups on board with using it regularly. If it doesnt have management backing, your security teams have little to no influence in getting this process off the ground fully.

Incentivized

monday.com cannot be integrated with CI/CD tools, whereas Atlassian Jira integrates with CI/CD tools seamlessly. Atlassian Jira has strong Agile and Scrum support. Coming to monday.com, it has basic agile functionality. But Atlassian Jira has a complex UI, and monday.com has an intuitive, drag-and-drop interface. Overall, Atlassian Jira provides features like Agile project management, DevOps integration, and customizable workflows.

Incentivized

SonarQube is an open-source. It's a scalable product. The costs for this application, for the kind of job it does, are pretty descent. Pipeline scan is more secured in SonarQube. Its a very good tool and its support multiple languages. Its main core competency is of static code analysis and that is why SonarQube exists and it does it exceedingly well. The quality of scan on code convention, best practices, coding standards, unit test coverage etc makes them one of the best competent tool in the market

Incentivized

Veracode is slower with scan results however the flaws discovered and sites crawled are almost the same. Rapid7 InsightAppSec only does dynamic scans. Veracode did find more links on a site crawl. Rapid7 InsightAppSec has more out of the box reports than Veracode. Both integration to DevOps tools were striaghtforward.

Incentivized

Product is rellay good but pricing part I am not aware

Incentivized

Atlassian Jira is highly stable and good with its performance and its has all the required scalability features as business needs

Incentivized

It meets our needs.

Incentivized

• Atlassian Jira's robust workflow automation has boosted team efficiency, shortening delivery cycles and driving a positive ROI through improved project management.
• Its advanced reporting and integration capabilities have enabled data-driven decisions, aligning operations with key business objectives.
• However, the steep learning curve can delay adoption, potentially hindering short-term ROI.

Incentivized

• Positive ROI from the standpoint of flagging several issues that would have otherwise likely been unaddressed and caused more time to be spent closer to launch
• Slightly positive ROI from time-saving perspective (it's an automated check which is nice, but depending on the issues it finds, can take developers time to investigate and resolve)

• Veracode's platform has had a very positive impact on our security posture, paving the path towards having coverage monitored automatically on hundreds of internal applications throughout the development lifecycle.
• Veracode's platform has also had a very positive impact on improving the security knowledge of our development team, providing meaningful feedback as well as training options to reduce mitigation time and help to prevent flaws before they are created.

Incentivized