Veracode provides advanced application security solutions, trusted by enterprises to develop and maintain secure software. Its platform identifies exploitable risks, speeds up vulnerability remediation, and reduces security debt at scale using a proprietary AI-assisted remediation engine.
Buzilla is easy to use and provides basic functionality to use as a bug tracking tool. If big size attachments are allowed it would have been great. Also with Bugzilla home->Test management area is improved by allowing multiple sections it would be awesome!
Veracode is well suited for development applications that can be made more secure right from the beginning. There is an excellent extension in Visual Studio that scans code from the IDE. However, it is less appropriate or incompatible with scanning SOAP or WSDL APIs. It supports only REST APIs.
Open source! No license fee involved, no limit to the number of licenses.
Easy to install and maintain. Installation is very easy and hardly needs any maintenance efforts, except when migrating from one version to other. Each project can have its own group of users.
Includes all the core features/fields that are needed to log a software bug/issue.
Multiple attachments are possible, supports various formats.
Good for reporting. Filtering mechanism lets you query bugs by various parameters.
Veracode performs Static Application Security Testing (SAST) very well by finding flaws in the code using entry points so that it tests for everything a user can interact with in the application. This approach is very helpful for avoiding a lot of false positives early on.
Veracode performs SCA automatically on every SAST scan, so that we don't have to manually scan the application again for SCA scans.
Veracode integrates very well with the ticketing tools, so that it becomes very easy to track every finding and its status within our ticketing tool.
Cloud Based. I'd like to see bugzilla be cloud based. The company I currently work with made a final decision to change db's for this specific reason. Due to the frequency of travel in this company, they need access to bugzilla from differing national / international locations.
Larger File Attachments. I believe the limit of a bugzilla content upload is 4 megabytes. For many of our video'd issues, this file size is simply impractical without the additional effort exertion on video compressor applications.
For future projects I will look at something that is hosted in the cloud that I don't have to manage. I would also like something that has a more modern feel to allow my customers to use it as well as my employees.
At this time, and we just renewed a month ago, I dont see any products out there overall that can offer what Veracode does. Yes, its not cheap by any means, but for the money its the best application security scanning tool out there.
This is a pretty straightforward system. You put in the bug details, a ticket is created, the team is notified. The user interface reflects this very simple and straightforward flow. It's certainly much easier than trying to track bugs with using Excel and email.
- Almost no setup required and easy to configure - Very easy to use, intuitive UI with integrated analytics and learning portals. - Seamless to review the results, triage them, generate reports. - Security progression of the product/application is tracked via successive scans. - Privileges/Roles nicely fine grained and tightly controlled to let teams "view" only their products.
Since it is open source, it doesn't have customer service. However, the amount of information on forums is vast. If you can wade through it, you'll get what you need
Overall, Veracode support is helpful, community support is great, and documentation is available for self-service. Our Customer Success Manager is very helpful and reaches out regularly to see if we need assistance. We have not utilized many of the other resources offered by Veracode, however, in the future we would like to leverage secure coding training for our Development teams.
Implementation was pretty simple. Particularly because the product cannot be customized so there is not much to do apart from getting it up and running.
We use it as a SAS service, so really just getting our teams to mold the use of Veracode into their SDLC has been a process of years in the making. It comes down to what your teams are ready and willing to accept and change. Management is key in getting their groups on board with using it regularly. If it doesnt have management backing, your security teams have little to no influence in getting this process off the ground fully.
We migrated away from the whole suite of Rational tools because of their massive complexity around administration and inflexibility regarding workflows. In addition, the suite was insanely expensive, and users hated the usability of the tools. We evaluated, and liked JIRA, but because the organization was looking for cost savings, we ended up going with Bugzilla and it's FOSS model so as to avoid ongoing costs.
Veracode is slower with scan results however the flaws discovered and sites crawled are almost the same. Rapid7 InsightAppSec only does dynamic scans. Veracode did find more links on a site crawl. Rapid7 InsightAppSec has more out of the box reports than Veracode. Both integration to DevOps tools were striaghtforward.
It has made the SDLC process more efficient. Bugs were logged and tracked in emails or in Excel sheets leading to slow communication and at time version issues with multiple files. Being an online tool, Bugzilla solved those issues, improved communication, instant status updates and improved efficiency.
We have used Bugzilla with a lot of federal goverment agencies (DHS, CMS, SAMHSA, CDC, HHS etc). Project Directors adn Principle Investigators were at times given access to Bugzilla which provided a snapshot of open vs closed issues.
Some groups would resist using Bugzilla with the email reminders being the main reason. Turning off or reminding them of features where we can 'control' email notification helped a lot.
Veracode's platform has had a very positive impact on our security posture, paving the path towards having coverage monitored automatically on hundreds of internal applications throughout the development lifecycle.
Veracode's platform has also had a very positive impact on improving the security knowledge of our development team, providing meaningful feedback as well as training options to reduce mitigation time and help to prevent flaws before they are created.
