Codacy vs. Sonatype Vulnerability Scanner

I recommend it for companies that use several programming languages, as it supports several languages ​​such as Java, Javascript, Python, among others. However, for companies that use only one programming language, there are specific tools for each language that can be more complete in this scenario. I do not recommend it for companies that only use open source software, in which case there are other tools available.

Incentivized

Well suited for organizations with small application security team as the solution scales and is easy for devs to use. The only choice if you develop in Java as their data is the most accurate.

Incentivized

• Seamless and easy integrations with GitHub for fantastic pipeline of viewing errors.
• Intuitive UI which is easy to customize and built-in patterns recommendations and security checks helps to fix issues faster.
• Metrics and duplication and complexity easily identify areas that need attention to fix it easy.
• Great for open-source projects.

Incentivized

• There should be customization to get code quality for your own projects if standards are provided.
• Offline or a standalone application is much needed from Codacy to get local support.
• Spots a lot of errors and small ones that don't affect much about quality and are de-facto standards.

Incentivized

Great company and support team!

Incentivized

Even though it is paid while SonarQube is free, we chose Codacy because it is simpler to configure and maintain the implemented rules. In addition, it offers support for the main programming languages ​​on the market, ensuring that we can continue to use it if we want to use other languages ​​in new products.

Incentivized

• The integration of Codacy with new code base is quick and easy.
• Improves our code.
• Easy to detect errors easily.
• Ability to check duplicate codes.

Incentivized