Coverity Static Reviews

I use my company's solution for code quality and secure code analysis.

The tool as it is can be used for code quality improvement. Whatever rules are in the tool are useful.

I don't use it directly on a day-to-day basis.

I expect the product to offer ease of integration with the built pipelines. I had tried integrating the tool with Azure DevOps, but the report I got stated that my team faced many challenges. I do not know the exact details.

I have been using Coverity for a few years.

I use Coverity simultaneously with Fortify but for different purposes.

I don't deal with the pricing.

I am satisfied with the product.

The tool is used for specific use cases like embedded systems.

I would not recommend the tool for web application technologies, Java, or cloud-native technologies since the tool is meant for embedded codes.

I rate the tool a six out of ten.

We are using Coverity for Android, cluster programs, and infotainment.

Coverity's setup takes a long time. Coverity gives advisory and deviation features, which are some of the parts I liked.

SCM integration is very poor in Coverity. The IDR file is not portable. After the analysis, it generates an IDR file. It cannot be ported from the machine since it is machine specific. Also, the component mapping has to be done manually. We cannot upload in one shot through automation or an Excel sheet. That is also a drawback.

In terms of the additional features that the solution should possess, I would say that it should have very good and sound features for Android-related stuff and embedded features should be supported. Also, infotainment programs for people who are using HMI should be supported very well.

I have been using Coverity for more than one year. In my company, we use the tool. Also, we go to the vendor for support. I am using Coverity 2022.

Speaking about stability, I would say that product-wise, there is no such complaint. There are no alarming complaints. However, some minor things we have to fix, use and tune it. With the newer versions, the only problem is if any new version or any new tool or new plugin comes to our infotainment program, then even with vendor support, we won't get a solution since maybe the tool is not supported or because there is something else that has to be looked into. We are facing problems due to such cases. Otherwise, it's fine, so it is good enough for an existing tool and program.

The product is scalable if provided if the tool is supported well, and if new features are incorporated parallelly, then definitely it's scalable.

To speak exactly about the number of users is difficult, but above 300 people in my company use the solution.

There are four or five members out there who manage Coverity's administration from a project point of view.

My opinion on support depends on what kind of support my company has adopted. I need to check. I don't know what company support they have provided. If they have taken golden support, support will come like that. In that way, I don't want to comment on that.

Initially, I worked with Klocwork in my previous company.

Regarding Klocwork, if you can provide me with its information, then we would definitely like to explore it.

Initial setup for the infotainment program is not easy. This is because the template, specifically code template files, have to be generated, and that itself takes time since they talk to the vendor and they get the template files. We are using the same template file for most of the programs. It is not fixed that this program has to use this template file, so it is not like that. since it has to be fine-tuned.

For a few programs, like cluster programs, it takes only half a day or a day to get the setup done since everything is ready. But for infotainment, it sometimes takes three to four days, and issues keep coming in for the new enablement. Hence, it may take even three weeks to one month sometimes.

Coverity’s price is on the higher side. It should be lower. It's definitely priced on the higher side, and in that sense, I will definitely give a big alert stating that it is on the higher side of the price.

We use this tool for call scans in order to improve call quality. We implement testing and this tool cleans up our potential feedback. We are a semiconductor company and provide software solutions to our clients. I'm a senior manager. 

Coverity has improved our functionality and efficiency.

This product provides software security, and helps to find potential security bugs or defects with its checker feature. The solution also enables us to implement secure coding. 

We've found that there is a quite high false positive rate. It's a problem because we end up wasting time on something that's not an issue. The tracker reports too many issues that are not relevant. I'd like to see some kind of customization mechanism in the future. 

We've been using this solution for over 10 years. 

The solution is stable. 

The solution is scalable, we have several thousand users. 

The technical support is reasonable. 

Neutral

I rate this solution eight out of 10. 

We have been working on a POC for this solution. It is an on-prem solution and we have 50 internal users. 

This solution is easy to use. 

The level of vulnerability that this solution covers could be improved compared to other open source tools. The UI could also be improved. We also cannot directly report the vulnerability. We need to add filters to projects and only then can we download reports. 

I have been using this solution for three months. 

This is a stable solution. 

The pricing is very reasonable compared to other platforms. It is based on a three year license. 

I would rate this solution a seven out of ten. 

Our company has 500 developers and engineers who the solution for C/C++ core static analysis. One engineer handles all ongoing maintenance. 

The solution effectively identifies bugs in code. 

The solution is a bit complex to use in comparison to other products that have many plugins.

More features could be included for finding bugs and analyzing code. For example, more information could be included to explain errors such as memory leaks. 

I have been using the solution for one year. 

The solution is stable. 

The solution is scalable. 

Technical support is helpful and responsive. 

I rate support an eight out of ten. 

Positive

I have not used another solution. 

I would recommend the solution if it includes more features. 

I rate the solution an eight out of ten. 

We use the product only as a solution for defect code, to find more build liabilities in the code.

The product allows us to find vulnerabilities while testing our apps. 

The app analysis is the most valuable feature as I know other solutions don't have that.

It's a good tool. The interface, support, pricing, and integration do not have any limitations.

The solution could use more rules. For example, if I have a lot of rules in many languages, it helps my company as having access to more rules works for us.

We'd like a bit more integration.

I've been using the solution for maybe three months. 

The solution is stable. There are no bugs or glitches and it doesn't crash or freeze. It's reliable and the performance has been good overall. 

We find the solution to be scalable. 

I'm not sure exactly how many people are using the product.

I can't say if we have plans to increase usage or not in the future. 

We haven't had any issues with technical support. They are helpful and responsive. 

Positive

We also use SonarQube.

In the past, I used Checkmarx and Fortify, and Coverity had the better price.

I have access only to the interface part and I didn't do the configuration of the tool. I do not handle the initial setup of the product.

As I recall, the deployment itself only took days. 

Our company managed the setup in-house without the help of outside vendors. 

We find the pricing to be reasonable.

We're a customer and end-user.

We are using a recent version of the solution. 

I'd like potential new users to be aware that it's a good tool to implement basic code.

I'd rate the solution nine out of ten.

The product has deeper scanning capabilities. 

The tool needs to improve its reporting. 

I have been working with the product for one and a half years. 

The product's stability is good. 

The product is scalable since it can integrate CI/CD tools. My company has 10 users for the product. 

The solution's support is fast. 

Positive

The solution's setup is easy. 

The tool's price is somewhere in the middle. It's neither cheap nor expensive. I would rate the pricing a five out of ten. 

I would rate the solution a ten out of ten. 

I use the solution for static analysis.

The product has good API documentation. I’m quite happy with it. The product is easy to use.

Sometimes it's a bit hard to figure out how to use the product’s UI.

I have been using the solution for some years.

I have not faced any issues with the product’s stability.

The solution is scalable. Four people in my organization use the solution.

The initial setup is easy.

I am using the latest version of the product. I have also used Clang Static Analyzer. People planning to use the solution should try the open-source version first to understand how it works. We must have the paid version of the product to get all the resources and documentation. Overall, I rate the product an eight out of ten.

We use this solution to scan our products. We've integrated with our build system and it automatically completes the scanning.

The ability to scan code gives us details of existing and potential vulnerabilities. What really matters for us is to ensure that we are able to catch vulnerabilities ahead of time.

When I put my code into Coverity for scanning, the code information of the product is in the system. The solution could be improved by providing a SBOM, a software bill of material. They could also integrate a software composition analysis scan. This would make my job a bit easier.

There is scope for Coverity to look beyond static analysis. Most of people that I have spoken to use Coverity from a pure static analysis perspective. However, we also need to be able to view dynamic pages and APIs using dynamic scanning and SES scans. Currently we would need to use another solution to be able to do this. 

I have been using this solution for 10 years.

This is a stable solution.

This is a scalable solution.

From a support perspective, they are pretty responsive. I would rate them a five out of five. 

The the last ten years, our company has derived value from using this solution. We continuously evaluate our tech stack and if a better solution came along, we would consider it if it provided more value. 

This is a pretty expensive solution. The overall value of the solution could be improved if the price was reduced. Licensing is done on an annual basis. 

There are other new tools like Veracode, Java Icon and Javascript which are better than Coverity when it comes to visualization. Their cost is significantly lower compared to Synopsys. 

Coverity is really good with CC+ and legacy technologies. However, there are other products that are probably as good or even better than Coverity when it comes to Java or cloud applications. 

If someone were to ask me what tool I would recommend, my answer would depend on what technology they're using and what their use case is. My advice would be based on how they're going to use the product and what they're expecting from the tool.

I would rate this solution an eight out of ten. 

We are using GK and the latest version for port deployment.

I have been using Coverity for three and a half years.

Coverity is not stable but it is sufficient for our organization's requirements.

Coverity is scalable.

We contacted technical support to help us clean up an issue we had.

If they have a cluster structure, then definitely they should use Coverity. I would rate Coverity a nine out of ten.