GitLab is an intelligent orchestration platform for DevSecOps, where software teams enable AI at every stage of the software lifecycle to ship faster. The platform enables teams to automate repetitive tasks across planning, building, securing, testing, deploying, and maintaining software.
$0
per month per user
Veracode
Score8.5 out of 10
Mid-Size Companies (51-1,000 employees)
Veracode provides advanced application security solutions, trusted by enterprises to develop and maintain secure software. Its platform identifies exploitable risks, speeds up vulnerability remediation, and reduces security debt at scale using a proprietary AI-assisted remediation engine.
N/A
Pricing
Bugzilla
GitLab
Veracode
Editions & Modules
No answers on this topic
GitLab Free (self-managed)
$0
GitLab Free
$0
GitLab Premium
$29
per month per user
GitLab Premium (self-managed)
$29
per month per user
GitLab Ultimate
Contact Sales
GitLab Ultimate (self-managed)
Contact Sales
No answers on this topic
Offerings
Pricing Offerings
Bugzilla
GitLab
Veracode
Free Trial
No
Yes
Yes
Free/Freemium Version
No
Yes
Yes
Premium Consulting/Integration Services
No
Yes
Yes
Entry-level Setup Fee
No setup fee
Optional
No setup fee
Additional Details
—
GitLab Credits enable flexible, consumption-based access to agentic AI capabilities in the GitLab platform, allowing you to scale AI adoption at your own pace while maintaining cost predictability. Powered by Duo Agent Platform, GitLab’s agentic AI capabilities help software teams to collaborate at AI speed, without compromising quality and enterprise security.
If usage exceeds monthly allocations and overage terms are accepted, automated on-demand billing activates without service interruption, so your developers never lose access to AI capabilities they need.
Real-time dashboards provide transparency into AI consumption patterns. Software teams can see usage across users, projects, and groups with granular attribution for cost allocation. Automated threshold alerts facilitate proactive planning. Advanced analytics deliver trending, forecasting, and FinOps integration.
We selected Veracode after testing these tools with 3 important solutions and Veracode had a great ratio of findings, with low false positive, and the best price between the tools that were good enough.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Senior Software Engineer in Research & Development at SRB Education Solutions Inc. (Acquired by PowerSchool) (Information Technology & Services, 501-1000 employees)
Chose Veracode
Sonar cube was quicker, but not as thorough. Both integrated into our CI/CD pipeline, however the integration for Veracode is more straight forward.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Verified User
Chose Veracode
Veracode is much better at uncovering security weaknesses and providing information and consulting. I use Veracode because our company decided for.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Buzilla is easy to use and provides basic functionality to use as a bug tracking tool. If big size attachments are allowed it would have been great. Also with Bugzilla home->Test management area is improved by allowing multiple sections it would be awesome!
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
In general it's a good product with a huge number of features. It can do CI/CD checks, deployment, repo hosting, integrations etc. A lot of it can be managed from just the UI but also has an ok API. It does tend to release new features semi-often too which is nice. It can have a steep learning curve for certain features so not a starter-friendly vendor, but great for most businesses.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
Veracode helped us our team's developers in saving time significantly. For instance, if I take a library and assume it's going to work until it reaches QA or UAT, where we find out there's a vulnerability, that can require extensive effort for code refactoring or redesigning; Veracode helps prevent that before the pull request is merged.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Open source! No license fee involved, no limit to the number of licenses.
Easy to install and maintain. Installation is very easy and hardly needs any maintenance efforts, except when migrating from one version to other. Each project can have its own group of users.
Includes all the core features/fields that are needed to log a software bug/issue.
Multiple attachments are possible, supports various formats.
Good for reporting. Filtering mechanism lets you query bugs by various parameters.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
It is good at recommending fixing issues with third-party dependencies used in application code with detailed version information and knowing which version fixes what.
It has a very nice interface for triaging flaws. One can sort the vulnerabilities found in code from Very Likely to be exploited to least likely to be exploited.
There is a collections feature that allows us to group together groups of application profiles belonging to the same suite of applications.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Cloud Based. I'd like to see bugzilla be cloud based. The company I currently work with made a final decision to change db's for this specific reason. Due to the frequency of travel in this company, they need access to bugzilla from differing national / international locations.
Larger File Attachments. I believe the limit of a bugzilla content upload is 4 megabytes. For many of our video'd issues, this file size is simply impractical without the additional effort exertion on video compressor applications.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
For future projects I will look at something that is hosted in the cloud that I don't have to manage. I would also like something that has a more modern feel to allow my customers to use it as well as my employees.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
I really feel the platform has matured quite faster than others, and it is always at the top of its game compared to the different vendors like GitHub, Azure pipelines, CircleCI, Travis, Jenkins. Since it provides, agents, CI/CD, repository hosting, Secrets management, user management, and Single Sign on; among other features
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
At this time, and we just renewed a month ago, I dont see any products out there overall that can offer what Veracode does. Yes, its not cheap by any means, but for the money its the best application security scanning tool out there.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
This is a pretty straightforward system. You put in the bug details, a ticket is created, the team is notified. The user interface reflects this very simple and straightforward flow. It's certainly much easier than trying to track bugs with using Excel and email.
- As a combination of features and products, GitLab is a really great tool for developers. - Also, it comes with both light and quick changes in a web browser version, as well as pro work in VS Code mode. However, in certain areas, such as large-scale issues/incidents, management can be improved.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
- Almost no setup required and easy to configure - Very easy to use, intuitive UI with integrated analytics and learning portals. - Seamless to review the results, triage them, generate reports. - Security progression of the product/application is tracked via successive scans. - Privileges/Roles nicely fine grained and tightly controlled to let teams "view" only their products.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
I've never had experienced outages from GItlab itself, but regarding the code I have deployed to Gitlab, the history helps a lot to trace the cause of the issue or performing a rollback to go back to a working version
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
GItlab reponsiveness is amazing, has never left me IDLE. I've never had issues even with complex projects. I have not experienced any issues when integrating it with agents for example or SSO
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Since it is open source, it doesn't have customer service. However, the amount of information on forums is vast. If you can wade through it, you'll get what you need
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
At this point, I do not have much experience with Gitlab support as I have never had to engage them. They have documentation that is helpful, not quite as extensive as other documentation, but helpful nonetheless. They also seem to be relatively responsive on social media platforms (twitter) and really thrived when GitHub was acquired by Microsoft
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Overall, Veracode support is helpful, community support is great, and documentation is available for self-service. Our Customer Success Manager is very helpful and reaches out regularly to see if we need assistance. We have not utilized many of the other resources offered by Veracode, however, in the future we would like to leverage secure coding training for our Development teams.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
Implementation was pretty simple. Particularly because the product cannot be customized so there is not much to do apart from getting it up and running.
We use it as a SAS service, so really just getting our teams to mold the use of Veracode into their SDLC has been a process of years in the making. It comes down to what your teams are ready and willing to accept and change. Management is key in getting their groups on board with using it regularly. If it doesnt have management backing, your security teams have little to no influence in getting this process off the ground fully.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
We migrated away from the whole suite of Rational tools because of their massive complexity around administration and inflexibility regarding workflows. In addition, the suite was insanely expensive, and users hated the usability of the tools. We evaluated, and liked JIRA, but because the organization was looking for cost savings, we ended up going with Bugzilla and it's FOSS model so as to avoid ongoing costs.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
GitHub is an inferior product from most points of view. We had to use it and the teams finds no positives about it. Everything is a downgrade from our previous GitLab solution. GitLab CI\CD is vastly superior to workflows, for example doing a manual node is just "when : manual" in GitLab while you have to do clickops in GitHub to achieve the same. No overview of code in branches is a minus when we tried to figure out what our colleagues are trying to merge as it looked off.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
Veracode is slower with scan results however the flaws discovered and sites crawled are almost the same. Rapid7 InsightAppSec only does dynamic scans. Veracode did find more links on a site crawl. Rapid7 InsightAppSec has more out of the box reports than Veracode. Both integration to DevOps tools were striaghtforward.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
It has made the SDLC process more efficient. Bugs were logged and tracked in emails or in Excel sheets leading to slow communication and at time version issues with multiple files. Being an online tool, Bugzilla solved those issues, improved communication, instant status updates and improved efficiency.
We have used Bugzilla with a lot of federal goverment agencies (DHS, CMS, SAMHSA, CDC, HHS etc). Project Directors adn Principle Investigators were at times given access to Bugzilla which provided a snapshot of open vs closed issues.
Some groups would resist using Bugzilla with the email reminders being the main reason. Turning off or reminding them of features where we can 'control' email notification helped a lot.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. TR verified that a representative sample of customers was invited. More Info
Positive: Scanning all our applications on Veracode provides us an overview of our cyber security posture for the organization as a whole.
Positive: Performing the SAST, SCA and DAST scanning for all the applications at the early stages of the SDLC helps us identify and mitigate security vulnerabilities early, reducing the risk of data breaches and cyber-attacks.
Negative: Sometimes Veracode SAST scanner closed and reopens some findings, leading to reliability issues on the scanner itself.
A de minimis incentive was given to thank the reviewer for their time. The incentive was not used to bias or drive a particular response, nor was the incentive contingent on a positive endorsement. More Info
