Development and DevOps Integrations

Micro Focus AccuRev is a software configuration management tool that addresses complex parallel and distributed development environments with a stream-based architecture to accelerate development and improve asset reuse.

Integrates with Coverity

• Support community

Trigger security scans based on code changes, provide actionable developer feedback through GitHub code scanning or annotated pull requests, and fail the pipeline if critical security issues are found.

Integrates with Coverity and Intelligent Orchestration

• Support community

Subversion by Apache is an open source version control system.

Integrates with Coverity

• Support community

Trigger security scans based on code changes, provide actionable developer feedback through annotated pull requests, and fail the pipeline if critical security issues are found.

Integrates with Coverity

• Support community

Trigger security scans based on code changes, provide actionable developer feedback in the GitLab security center or annotated pull requests, and fail the pipeline if critical security issues are found.

Integrates with Coverity and Intelligent Orchestration

• Support community

Trigger security scans based on code changes, provide actionable developer feedback through annotated pull requests, and fail the pipeline if critical security issues are found.

Integrates with Coverity and Intelligent Orchestration

• Support community

Helix Core version control by Perforce is enterprise-class version control software that tracks and manages changes to all your digital assets.

Integrates with Coverity

• Support community

Concurrent Versions System (CVS) is a free, client-server-based version control system that records the history of sources files and documents.

Integrates with Coverity

• Support community

Mercurial is a free, distributed source control management tool.

Integrates with Coverity

• Support community

Android Studio by Google provides tools for building apps on every type of Android device.

Integrates with Coverity

• Support community

PhpStorm by JetBrains is a PHP IDE that provides built-in tools for debugging, testing, and profiling PHP applications.

Integrates with Coverity (via Code Sight), Coverity

• Support community

Microsoft Visual Studio enables you to build web, mobile, and native applications for multiple operating systems and devices with C#, C++, Node.js, F#, Python, or Visual Basic.

Integrates with Code Dx, Black Duck (via Code Sight), Coverity (via Code Sight), Coverity

• Support community

The Eclipse IDE is known as a Java IDE, but also includes variants for C/C++, JavaScript/TypeScript, PHP, and more.

Integrates with Code Dx, Coverity (via Code Sight), Black Duck (via Code Sight), Coverity

• Support community

PyCharm by JetBrains is a Python IDE that brings all Python tools together in one place.

Integrates with Coverity (via Code Sight), Coverity

• Support community

Microsoft Visual Studio Code is a streamlined open source code editor with support for development operations like debugging, task running, and version control.

Integrates with Coverity (via Code Sight), Coverity

• Support community

IBM Engineering Workflow Management (formerly Rational Team Concert) is a collaborative software development tool that teams use to manage all aspects of their work.

Integrates with Coverity

• Support community

The QNX Momentics Tool Suite by Blackberry offers an Eclipse-based IDE and command-line tools that will be familiar to anyone who’s worked with Linux.

Integrates with Coverity

• Support community

WebStorm by JetBrains is a JavaScript IDE for intelligent code completion, on-the-fly error detection, powerful navigation, and refactoring for JavaScript, TypeScript, stylesheet languages, and other popular frameworks.

Integrates with Black Duck (via Code Sight), Coverity (via Code Sight), Coverity

• Support community

IntelliJ IDEA by JetBrains is an IDE for JVM that helps maximize developer productivity with intelligent coding assistance and ergonomic design.

Integrates with Code Dx, Black Duck (via Code Sight), Coverity (via Code Sight), Coverity

• Support community

RubyMine by JetBrains is an IDE that helps Ruby on Rails developers be more productive in every aspect of Ruby/Rails project development.

Integrates with Coverity (via Code Sight), Coverity

• Support community

Wind River Workbench is a complete suite of developer tools for software running on Wind River Systems platforms.

Integrates with Coverity

• Support community

The Bazel build system by Google helps developers build and test software of any size.

Integrates with Black Duck

• Support community

Composer is an open source dependency manager for PHP.

Integrates with Black Duck

• Support community

The Go Module CLI is used to manage Golang dependencies.

Integrates with Black Duck

• Support community

Apache Maven is an open source software project management and comprehension tool that can manage a project's build, reporting, and documentation from a central piece of information.

Integrates with Black Duck and Coverity

• Support community

Pip by the Python Packaging Authority (PyPA) is the open source package installer for Python that installs packages from the Python Package Index and other indexes.

Integrates with Black Duck

• Support community

Yarn is an open source package manager that also functions as a project manager.

Integrates with Black Duck and Coverity

• Support community

Bower manages web site components including frameworks, libraries, assets, and utilities.

Integrates with Coverity

• Support community

Comprehensive Perl Archive Network (CPAN) is a large collection of Perl software and documentation.

Integrates with Black Duck

• Support community

Go Vndr is simple, open source vendoring tool for Golang.

Integrates with Black Duck

• Support community

The open source npm registry is the center of JavaScript code-sharing and the largest software registry in the world.

Integrates with Black Duck and Coverity

• Support community

Poetry is an open source Python packaging and dependency manager.

Integrates with Black Duck

• Support community

The Yocto Project (YP) is a Linux Foundation collaborative open source project that creates custom Linux distributions.

Integrates with Black Duck

• Support community

Cargo by Mozilla is the Rust community’s crate registry.

Integrates with Black Duck

• Support community

Conan by JFrog is an open source, decentralized, and multiplatform package manager used to create and share native binaries.

Integrates with Black Duck

• Support community

Gogradle is an open source Gradle plugin that provides modern build support for Golang.

Integrates with Black Duck

• Support community

NuGet is the open source package manager for .NET. 

Integrates with Black Duck

• Support community

Rebar3 is an Erlang tool that makes it easy to create, develop, and release Erlang libraries, applications, and systems in a repeatable manner.

Integrates with Black Duck

• Support community

CocoaPods is an open source dependency manager for Swift and Objective-C Cocoa projects.

Integrates with Black Duck

• Support community

Conda is an open source package management system and environment management system that runs on Windows, macOS, and Linux. 

Integrates with Black Duck

• Support community

Lerna is an open source tool for managing JavaScript projects with multiple packages.

Integrates with Black Duck

• Support community

Packrat by Rstudio is an open source dependency management system for the R programming language.

Integrates with Black Duck

• Support community

RubyGems is the Ruby community’s gem hosting service.

Integrates with Black Duck

• Support community

Amazon Web Services (AWS) CodeBuild is a fully managed, continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy.

Integrates with Black Duck

• Support community

CircleCI by Circle Internet Services automates your development process with continuous integration in its cloud or on your own infrastructure.

Integrates with Black Duck

• Support community

Trigger security scans based on code changes, provide actionable developer feedback through GitHub code scanning or annotated pull requests, and fail the pipeline if critical security issues are found.

Integrates with Black Duck, Coverity, and Intelligent Orchestration

• Support community

sbt is an open source software build tool for building, testing, and deploying Scala and Java projects.

Integrates with Black Duck

• Support community

Trigger security scans based on code changes, provide actionable developer feedback through annotated pull requests, and fail the pipeline if critical security issues are found.

Integrates with Black Duck, Coverity, and Seeker

• Support community

CloudBees Software Delivery Automation is a centralized solution that manages Jenkins Controllers, providing scalable security, compliance, and efficiency of Jenkins in enterprises.

Integrates with Black Duck and Intelligent Orchestration

• Support community

Trigger security scans based on code changes, provide actionable developer feedback in the GitLab security center or annotated pull requests, and fail the pipeline if critical security issues are found.

Integrates with Black Duck and Intelligent Orchestration

• Support community

TeamCity by JetBrains is a general-purpose CI/CD solution that allows flexibility for many types of workflows and development practices.

Integrates with Black Duck and Code Dx

• Support community

Trigger security scans based on code changes, provide actionable developer feedback through annotated pull requests, and fail the pipeline if critical security issues are found.

Integrates with Black Duck and Code Dx

• Support community

CodeShip by CloudBees is a software-as-a-service (SaaS) solution that empowers engineering teams to implement and optimize CI and CD in the cloud.

Integrates with Black Duck

• Support community

Gradle is a build automation tool that helps teams build, automate, and deliver better software faster.

Integrates with Black Duck and Coverity

• Support community

Travis CI is a continuous integration platform that enables teams to test and ship applications with confidence.

Integrates with Black Duck

• Support community

Bamboo by Atlassian for continuous integration, deployment, and delivery ties automated builds, tests, and releases together in a single workflow.

Integrates with Black Duck, and Code Dx

• Support community

Concourse by VMware is an open source CI/CD platform that is flexible and can be used for many kinds of automation.

Integrates with Black Duck

• Support community

Run security scan as part of your CI/CD pipeline and prevent security issues from escaping to production.

Integrates with Black Duck, Code Dx, Coverity, and Seeker

• Support community

Wind River Studio is a cloud-native platform for the development, deployment, operations, and servicing of mission-critical intelligent edge systems that require security, safety, and reliability.

Integrates with Coverity

• Support community

Amazon Elastic Container Registry (ECR) is a fully managed container registry that stores, manages, shares, and deploys your container images and artifacts anywhere.

Integrates with Black Duck

• Support community

The Google Container Registry is a single place to manage Docker images, perform vulnerability analysis, and decide who can access what with fine-grained access control.

Integrates with Black Duck

• Support community

Artifactory by JFrog is a repository manager that fully supports packages, container images, and Helm charts as they move across the entire DevOps pipeline.

Integrates with Black Duck

• Support community

The Nexus Repository by Sonatype enables you to manage binaries and build artifacts across your software supply chain.

Integrates with Black Duck

• Support community

The Azure Container Registry by Microsoft enables you to build, store, secure, scan, replicate, and manage container images and artifacts with a fully managed, geo-replicated instance of OCI distribution.

Integrates with Black Duck

• Support community

The Docker Registry is a stateless, highly scalable, server-side application that stores and lets you distribute Docker images.

Integrates with Black Duck

• Support community

Manage Synopsys security findings from within Azure Boards, and provide developers with actionable remediation giudance.

Integrates with Black Duck

• Support community

Slack is a channel-based messaging platform that enables teams to work together more effectively while connecting all their software tools and services.

Integrates with Intelligent Orchestration, Seeker, and Black Duck

• Support community

Bugzilla is server software designed to help you manage software development.

Integrates with Coverity

• Support community

Software Package Data Exchange (SPDX) by the Linux Foundation reduces redundant work by providing a common format for companies and communities to share important data, streamlining and improving compliance.

Integrates with Black Duck

• Support community

Manage Synopsys security findings from within Jira, and provide developers with actionable remediation guidance.

Integrates with Black Duck, Coverity, and Seeker

• Support community

Microsoft Teams enables you to meet, chat, call, and collaborate in one place.

Integrates with Black Duck

• Support community

Acunetix by Invicti Security is an automated web application security testing tool that audits web applications by checking for exploitable vulnerabilities.

Integrates with Code Dx

• Support community

The Aqua Cloud Native Security Platform (CNAPP) protects your entire stack, on any cloud, across virtual machines (VMs), containers, and serverless.

Integrates with Code Dx

• Support community

Checkmarx Interactive Application Security Testing (CxIAST) automates the detection of runtime vulnerabilities during functional testing.

Integrates with Code Dx

• Support community

The Clang Static Analyzer is a source code analysis tool that finds bugs in C, C++, and Objective-C programs.

Integrates with Code Dx

• Support community

Contrast Assess is an interactive application security testing solution that infuses software with vulnerability assessment capabilities so that security flaws are automatically identified.

Integrates with Code Dx

• Support community

Errcheck is an open source program that searches for unchecked errors in Go programs.

Integrates with Code Dx

• Support community

Fortify Software Security Center by CyberRes, a Micro Focus line of business, is a suite of tightly integrated solutions that fix and prevent security vulnerabilities in applications.

Integrates with Code Dx

• Support community

Gendarme by Mono (sponsored by Microsoft) is an open source, extensible, rule-based tool that finds problems in .NET applications and libraries.

Integrates with Code Dx

• Support community

HCL AppScan delivers scalable application security testing and risk management capabilities to help enterprises manage risk and compliance.

Integrates with Code Dx

• Support community

JSHint is an open source static analysis tool that detects errors and potential problems in JavaScript code.

Integrates with Code Dx and Coverity

• Support community

Netsparker by Invicti is an automated, fully configurable web application security scanner that enables you to scan websites, web applications, and web services for security flaws.

Integrates with Code Dx

• Support community

NowSecure INTEL provides third-party mobile app vetting to assess the security of any app on the Apple App Store or Google Play Store, to help you determine whether to allow the app within your environment.

Integrates with Code Dx

• Support community

Parasoft C/C++test is a unified, fully integrated testing solution for C/C++ software development.

Integrates with Code Dx

• Support community

PHP_CodeSniffer is an open source tool for finding violations of PHP coding standards.

Integrates with Code Dx

• Support community

Qualys Vulnerability Management (VM) provides global visibility into where IT assets are vulnerable and how to protect them.

Integrates with Code Dx

• Support community

Scalastyle is an open source Scala-style checker that examines Scala code and indicates potential problems with it.

Integrates with Code Dx

• Support community

Snyk Container is a vulnerability management tool for container and Kubernetes security to help developers find and fix vulnerabilities in cloud-native applications.

Integrates with Code Dx

• Support community

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over database servers.

Integrates with Code Dx

• Support community

DefenseCode ThunderScan is a static application security testing (SAST) solution that performs deep and extensive security analysis of application source code.

Integrates with Code Dx

• Support community

Veracode Software Composition Analysis (SCA) detects open source vulnerabilities to manage open source risk.

Integrates with Code Dx

• Support community

Visual Studio Code Analysis is the Microsoft Visual Studio built-in static source code analyzer for .NET and C++.

Integrates with Code Dx and Coverity

• Support community

Anchore Enterprise is a complete container security workflow solution.

Integrates with Code Dx

• Support community

Arachni is an open source web application security scanner framework that creates automated security reports for your website as it evolves.

Integrates with Code Dx

• Support community

Checkmarx Software Composition Analysis (CxSCA) provides accurate, relevant, and actionable open source risk insight.

Integrates with Code Dx

• Support community

Code Cracker is an open source analyzer library for C# and Visual Basic that uses Roslyn to produce refactorings, code analysis, and more.

Integrates with Code Dx

• Support community

Cppcheck is an open source static analysis tool for the C and C++ programming languages.

Integrates with Code Dx

• Support community

Error Prone is an open source static analysis tool for Java that can help find potential issues within the Android codebase.

Integrates with Code Dx

• Support community

Fortify Static Code Analyzer by CyberRes, a Micro Focus line of business, is a static application security testing tool that enables developers to find and fix security defects in real time during the coding process.

Integrates with Code Dx

• Support community

Gocyclo calculates cyclomatic complexities of functions in Go source code.

Integrates with Code Dx

• Support community

Ineffassign detects ineffectual assignments in Go code.

Integrates with Code Dx

• Support community

The Microsoft Threat Modeling Tool makes threat modeling easier for all developers through a standard notation for visualizing system components, data flows, and security boundaries.

Integrates with Code Dx

• Support community

Nexus Lifecycle by Sonatype is a software composition analysis tool that continuously monitors and identifies potential issues and uses your policies to automatically fix them for you.

Integrates with Code Dx

• Support community

NowSecure Workstation is a preconfigured hardware and software kit that compresses mobile app vulnerability assessment down to hours and enables repeatable, standards-based testing with pre-formatted reporting.

Integrates with Code Dx

• Support community

Parasoft dotTEST is a C# and .NET static analysis tool that verifies C# and VB.NET code quality and checks compliance with industry and security standards.

Integrates with Code Dx

• Support community

The phpcs-security-audit analyzer is a set of PHP_CodeSniffer rules for finding security vulnerabilities and weaknesses in PHP code.

Integrates with Code Dx

• Support community

Qualys Web Application Scanning (WAS) is a robust cloud solution for continuous web app discovery and detection of vulnerabilities and misconfigurations.

Integrates with Code Dx

• Support community

SD Elements by Security Compass provides tailored security requirements, design advice, secure coding standards, and step-by-step testing instructions on how to build secure applications from the ground up.

Integrates with Code Dx

• Support community

Snyk Open Source automatically detects vulnerabilities and accelerates fixing them throughout your development process.

Integrates with Code Dx

• Support community

Staticcheck is an open source linter for the Go programming language that uses static analysis to finds bugs and performance issues, offers simplifications, and enforces style rules.

Integrates with Code Dx

• Support community

Trustwave App Scanner automates the process of finding security vulnerabilities in web applications and services.

Integrates with Code Dx

• Support community

Veracode Static Analysis provides fast, automated feedback to developers in the IDE and CI/CD pipeline, conducts a full policy scan before deployment, and gives clear guidance on how to find, prioritize, and fix issues fast.

Integrates with Code Dx

• Support community

WhiteSource software composition analysis (SCA) for security and license automates open source management workflows.

Integrates with Code Dx

• Support community

The Android Studio Lint tool by Google scans Android project sources for potential bugs.

Integrates with Code Dx

• Support community

Brakeman is an open source vulnerability scanner specifically designed for Ruby on Rails applications that statically analyzes Rails application code to find security issues at any stage of development.

Integrates with Code Dx

• Support community

Checkmarx Static Application Security Testing (CxSAST) is a static analysis solution that identifies security vulnerabilities in custom code.

Integrates with Code Dx

• Support community

CodePeer by AdaCore is an Ada source code analyzer that detects runtime and logic errors and assesses potential bugs before program execution.

Integrates with Code Dx

• Support community

Deepfactor enables engineering teams to quickly discover and resolve security vulnerabilities, software supply chain risks, and compliance violations early in development and testing.

Integrates with Black Duck

OWASP Dependency-Check is an open source software composition analysis (SCA) tool that detects publicly disclosed vulnerabilities within a project's dependencies.

Integrates with Code Dx

• Support community

ESLint is an open source static analysis tool that identifies problematic patterns in JavaScript code.

Integrates with Code Dx

• Support community

Fortify WebInspect is an automated and configurable web application security testing tool that mimics real-world hacking techniques and attacks.

Integrates with Code Dx

• Support community

Golint is a linter for Go source code (deprecated).

Integrates with Code Dx

• Support community

JFrog Xray is a universal impact analysis product that enhances artifact security, container security, and open source software license compliance across your DevSecOps pipeline.

Integrates with Code Dx

• Support community

Mobile Secure by Data Theorem is a continuous automated security service that finds vulnerabilities and data privacy issues within mobile (iOS and Android) applications.

Integrates with Code Dx

• Support community

Nmap (Network Mapper) is a free and open source license security scanner utility for network discovery and security auditing.

Integrates with Code Dx

• Support community

OCLint is an open source static analysis tool for improving quality and reducing defects by inspecting C, C++, and Objective-C code for potential problems.

Integrates with Code Dx

• Support community

Parasoft Jtest is an integrated Java testing tool for application software development.

Integrates with Code Dx

• Support community

Prisma Cloud by Palo Alto Networks is a cloud-native security platform that secures infrastructure, applications, data, and entitlements across hybrid and multicloud environments.

Integrates with Code Dx

• Support community

Retire.js helps you detect the use of JavaScript library versions with known vulnerabilities.

Integrates with Code Dx

• Support community

Security Code Scan (SCS) is an open source static code analyzer for .NET.

Integrates with Code Dx

• Support community

Snyk Open Source License Compliance Management helps you maintain a rapid development pace while remaining compliant with the open source software licenses in your projects.

Integrates with Code Dx

• Support community

Tenable.io container security provides visibility into the security of container images, identifying vulnerabilities, malware, and policy violations through integration with the build process.

Integrates with Code Dx

• Support community

Veracode Dynamic Analysis scans web applications, finds exploitable vulnerabilities, and addresses issues immediately.

Integrates with Code Dx

• Support community

Vet examines Go source code and reports suspicious constructs.

Integrates with Code Dx

• Support community

AppSpider by Rapid7 is a dynamic application security testing solution that enables you to scan web and mobile applications for vulnerabilities.

Integrates with Code Dx

• Support community

Burp Suite by PortSwigger is a set of tools used to penetration test web applications.

Integrates with Code Dx

• Support community

Checkstyle is an open source static analysis tool that checks if Java source code is compliant with specified coding rules.

Integrates with Code Dx

• Support community

CodeSonar by GrammaTech is a static analysis tool used to find and fix bugs and security vulnerabilities in source and binary code.

Integrates with Code Dx

• Support community

OWASP Dependency-Track is an intelligent component analysis platform that enables you to identify and reduce risk in the software supply chain.

Integrates with Code Dx

• Support community

OWASP Find Security Bugs is a SpotBugs plugin for security audits of Java web and Android applications.

Integrates with Code Dx

• Support community

GDS PMD Secure Coding Ruleset is a set of custom rules for the PMD static analyzer that finds security weaknesses.

Integrates with Code Dx

• Support community

Gosec is a Golang security checker static analysis tool that inspects source code for security problems by scanning the Go AST.

Integrates with Code Dx

• Support community

Jlint checks Java code for bugs, inconsistencies, and synchronization problems by performing data flow analysis and building the lock graph.

Integrates with Code Dx

• Support community

Nessus is a vulnerability assessment solution that scans network computers for vulnerabilities.

Integrates with Code Dx

• Support community

NowSecure Auto makes it easy to integrate security testing into your mobile software development life cycle by automating the static, dynamic, and interactive analysis of your Android and iOS apps.

Integrates with Code Dx

• Support community

OWASP Zed Attack Proxy (ZAP) is an open source web application security scanner.

Integrates with Code Dx

• Support community

PHP Mess Detector (PHPMD) looks for potential quality problems within a given PHP source codebase.

Integrates with Code Dx

• Support community

Pylint is a source code, bug, and quality checker for the Python programming language.

Integrates with Code Dx

• Support community

SafeSQL is an open source static analysis tool for Go that protects against SQL injections.

Integrates with Code Dx

• Support community

Sentinel by NTT Security AppSec Solutions (formerly WhiteHat Security) is a software-as-a-service platform that enables businesses to deploy a scalable application security program across the entire software development life cycle.

Integrates with Code Dx

• Support community

SpotBugs is an open source program that uses static analysis to look for bugs in Java code.

Integrates with Code Dx and Coverity

• Support community

Tenable.sc consolidates and evaluates vulnerability data across the enterprise, prioritizing security risks and providing a clear view of your security posture.

Integrates with Code Dx

• Support community

Veracode Manual Penetration Testing (MPT) combines the skills of penetration testers with automated security testing scan results to reduce application risk, meet compliance requirements, and help teams understand and report on security posture.

Integrates with Code Dx

• Support community

Vex vulnerability explorer is a web application security scanner.

Integrates with Code Dx

• Support community

Brinqa is a unified risk management tool that enables stakeholders, governance organizations, and infrastructure and security teams to manage technology risk effectively.

Integrates with Black Duck and Coverity

• Support community

ZeroNorth brings security, DevOps, and business teams together to improve application security performance and reduce organizational risk. 

Integrates with Black Duck and Coverity

• Support community

Kenna Security, part of Cisco, is modern, risk-based vulnerability management software.

Integrates with Black Duck and Coverity

• Support community

SonarQube by SonarSource is a vulnerability management tool for code quality and security.

Integrates with Code Dx, Coverity, and Intelligent Orchestration

• Support community

ThreadFix by the Denim Group provides a comprehensive risk view from applications and their supporting infrastructure.

Integrates with Black Duck and Coverity

• Support community

The Amazon Web Services (AWS) cloud computing platform provides the flexibility to launch applications regardless of use case or industry.

Integrates with Seeker

• Support community

Kubernetes (K8s) open source container-orchestration system that provides automated container deployment, scaling, and management.

Integrates with Black Duck

• Support community

Cloud Foundry by the Cloud Native Computing Foundation (CNCF) provides a model for cloud-native application delivery on top of Kubernetes.

Integrates with Seeker

• Support community

Microsoft Azure is a cloud platform that helps you build, run, and manage applications across multiple clouds, on premises, hybrid, or at the edge, with the tools and frameworks of your choice.

Integrates with Black Duck

• Support community

Google Cloud is a suite of cloud computing services, including data management, hybrid and multicloud, and AI and ML, that consist of physical assets and virtual resources contained in Google data centers.

Integrates with Black Duck

• Support community

Red Hat OpenShift is a hybrid cloud platform that works anywhere, so you can build anything.

Integrates with Black Duck and Seeker

• Support community

IBM Cloud Pak for Applications is an enterprise-ready, containerized software solution for modernizing existing applications and developing new cloud-native apps that run on Red Hat OpenShift.

Integrates with Black Duck

• Support community

VMware Tanzu is a suite of products and solutions that enables you to build, run, and manage Kubernetes-controlled, container-based applications.

Integrates with Seeker

• Support community