Checkmarx vs. Findbugs

Chechmarx is really suited for finding wide range of security risks. It although identifies false positives which can be confusing at times. It can do better in terms of scan duration. They are better alternate competitors in the market who can do equally good or even better. It all depends on the scope of the problem you want to address

Incentivized

Findbugs is best suited even when you want to adapt to certain coding conventions and discover possible bugs beforehand and it's best suited for the java open source. whether you are a developer or a DevOps engineer you can even use it as a plugin in your Jenkins pipeline or any other build automation server and your developer tool such as visual studio as well.

Incentivized

• Reporting
• Language support
• Fix recommendations

Incentivized

• Scan the code for existing bugs present
• It can detect an vulnerabilities and also show possible bad warnings
• Can help identify errors in advance to avoid code crash post deployment

Incentivized

• Lots of false positives
• Hard to integrate with CI

Incentivized

• It’s documentation is not always up to date
• Difficulty in finding a prper solution when an issue arises during its configuration
• has limited features

Incentivized

We actually use Checkmarx along with the other tools. However, the reason we chose Checkmarx is its wide support for languages and useful fix recommendations. The flowcharts help better understand the data flow and give a clear picture of what needs to be fixed and how. Also, developers can make a note of what should be avoided in the future. Overall, it's a great tool and would be a good investment to make.

Incentivized

Sonar cloud has its own cloud where all the code vulnerabilities are collected and stored as a whole whereas its a plugin that is used in a code itself but the cons is that SonarCloud needs a license if you want to use it privately and also requires personal access token authentication if used with an external service

Incentivized

• Improved ability to provide high level of IA confidence
• Improved confidence in application-level security

Incentivized

• Its being used overall by most of the teams
• Some of the teams migrating to another testing tool as it has limited features
• Still recommend as its open source and beginners friendly

Incentivized