I worked for the company so I may be biased. That said, the customers who used it were happy with how well it worked, the depth of the analysis, and how few false positives were given. Review collected by and hosted on G2.com.

This is compiler-level analysis so for 50 million lines of code it takes time. The results are worth it. Review collected by and hosted on G2.com.

Coverity Scan is used for static code analysis of Open Source projects. It can analyze C, C++, and Java code.

Coverity’s static code analysis doesn’t run the code. Instead, it uses abstract interpretation to gain information about the code’s control flow and data flow. It’s able to follow all possible code paths that a program may take. For example, the analyzer understands that malloc() returns memory that must be freed with free() later. It follows all branches and function calls to see if all possible combinations free the memory. The analyzer is able to detect all sorts of issues like resource leaks (memory, file descriptors), NULL dereferencing, use after free, unchecked return values, dead code, buffer overflows, integer overflows, uninitialized variables, and many more. Review collected by and hosted on G2.com.

{"translation":"In some cases, it may not be precise. There could be incorrect identifications."} Review collected by and hosted on G2.com.

Organised way of keeping Defect records and quite through coverage of Code defects like memory leakage, unused variable, etc...

Good for CI/CD implementation.

Best for very large amount of Code and recudes manual power consumption majorly Review collected by and hosted on G2.com.

Not much coverage for Typescript and JavaScript.

It's Manual can be enhanced by adding more practical commands and real-time images Review collected by and hosted on G2.com.

I was there pretty early and the people were great - made some of my best friendships - Also, it was a new a tech and way of helping coders Review collected by and hosted on G2.com.

As the company grew, new management came in and the culture changed from what we new. It wasn' "bad", but it was different. Most people complain about changing culture so nothing shocking to report :) Review collected by and hosted on G2.com.

the way the coverity generates the report for various issue like "possible leak", "variable going outof scope", this helps in fixing the issues which developers would have introduced due to quick fixes in the code. Review collected by and hosted on G2.com.

Some of issues which are reported by coverity will be false positive, the tool can be improved in those areas and i also would like coverity to add support for run time code analysis. Review collected by and hosted on G2.com.

Coverity comes packed with loads of features for static code analysis. Review collected by and hosted on G2.com.

Not compatible with all of the programming languages. Review collected by and hosted on G2.com.

That it supports languages like C/C++ which most of the commercial tool don't support Review collected by and hosted on G2.com.

What I didn't like was tracing down the issues in source code file. Also, the user interface can be better. Review collected by and hosted on G2.com.

Passive code scanning

Quick turnaround

Cost-effective bug fixes

Helps to implement security as a process in day-to-day activities Review collected by and hosted on G2.com.

Speed in bug scanning

False alarms

Custom rules implementation

Cloud integration Review collected by and hosted on G2.com.

Identifying memory leaks, null dereference Review collected by and hosted on G2.com.

Coverity setup takes very long. Usability needs to be improved. Review collected by and hosted on G2.com.

It's detection, it's UI and its ability to kick out nice reports Review collected by and hosted on G2.com.

It did miss a few minor things when we compared against other scanners Review collected by and hosted on G2.com.