Gitlab hero border pattern left svg Gitlab hero border pattern right svg
Decision Kit
Decision Kit


Both Veracode and GitLab Ultimate offer open source component scanning along with Static and Dynamic Application Security Testing. Veracode is a mature product with a hefty price tag. Veracode offers a separate SAST-lite product that integrates in the developer’s IDE offering spell-check-like functionality to flag vulnerabilities as the developer types.

GitLab Ultimate automatically includes broad security scanning with every code commit including Static and Dynamic Application Security Testing, along with dependency scanning, container scanning, and license management.

Note: In November 2018, the private equity firm Thoma Bravo acquired Veracode from Broadcom. Veracode now functions as an independent company within the Thoma Bravo portfolio of companies. Between March 2017 and July 2018 Veracode was part of CA Technologies. For a brief period, from July 2018 to November 2018, Veracode was part of Broadcom following CA Technologies’ acquisition by Broadcom

Comparison to GitLab

Veracode is a well established player in the Application Security Testing (AST) market. Although they offer a range of products, including SAST, DAST, IAST, and SCA, each of these products are sold and licensed separately. GitLab offers simplicity and a high level of integration by including all of these types of scanning capabilities within a single product. Additionally, GitLab has tightly integrated the scanning results with the rest of the SLDC, including the merge request review process.

Additionally, organizations that have concerns about using a cloud-hosted scanning solution, or that use GitLab’s self managed offering, will find that GitLab is a clear winner as Veracode does not have an on-premise offering.

Security Scanning

Strengths and Weaknesses

  GitLab Veracode
Strengths   •     Tight out-of-the-box integration with the rest of the SDLC, including the merge request review process
  •     GitLab’s recent acquisitions of Peach Tech and Fuzzit provide Fuzzing capabilities that Veracode lacks
  •     Supports on-premise deployments including disconnected, offline, or air-gapped environments
  •     Strong offering across scanning types
  •     Nice, clean UX and design
  •     Strong offering across scanning types
  •     Tight integration with IDEs
  •     Strong offering across scanning types
  •     False positive rates are better than average
Weaknesses   •     GitLab’s SAST offering only scans code repositories today and cannot scan compiled binaries   •     Only available as a SaaS tool and cannot be deployed on-premise
  •     Not natively integrated into merge requests or the SDLC

Feature Lineup

  GitLab Veracode
SCA: Vulnerability Scanning
SCA: Open Source Audit
Fuzz Testing  
Feature Comparison


极狐GitLab支持在 CI/CD 流水线中轻松地运行静态应用安全测试 (SAST),检查易受攻击的源代码或应用程序包含的库中的已知安全问题,并将结果显示在合并请求和流水线视图中。此特性作为 Auto DevOps 的一部分来提供缺省的安全。

Learn more about Static Application Security Testing


极狐GitLab 允许您在流水线中运行密钥检测,检查是否有包含未察觉的密钥和证书代码提交。检查结果将被展示在合并请求和流水线中。这一特性将作为 Auto DevOps 的一部分来提供默认安全策略。

Learn more about Secret Detection


极狐GitLab 自动检测该应用所包含的库中已知的安全问题,从而保护您的应用在动态使用依赖项时免遭漏洞影响。检测结果会显示在合并请求和流水线视图中,此特性作为 Auto DevOps 一部分来提供缺省的安全性。

Learn more about Dependency Scanning


在应用运行后,极狐GitLab 支持在 CI/CD 流水线中运行动态应用安全测试(DAST),通过扫描您的应用以确保诸如 XSS 或无效身份验证之类的威胁不会影响到它。检测结果会显示在合并请求和流水线视图中,此特性作为 Auto DevOps 一部分来提供缺省的安全性。

Learn more about application security for containers

Interactive Application Security Testing

IAST combines elements of static and dynamic application security testing methods to improve the overall quality of the results. IAST typically uses an agent to instrument the application to monitor library calls and more. GitLab does not yet offer this feature.


在为您的应用程序构建 Docker 镜像时,极狐GitLab 可以运行安全扫描以确保它没有任何已知的代码交付环境中的漏洞。结果随后显示在合并请求和流水线视图中。此功能作为 Auto DevOps 的一部分来提供缺省的安全策略。

Learn more about container scanning



Learn more about License Compliance


一直等待下一次 CI 流水线的运行来检查您的站点是否存在漏洞,或是重现以前发现的漏洞是不合理的。极狐GitLab 提供了按需动态应用安全测试(DAST)来扫描正在运行的应用,它可以独立于代码更改和合并请求执行。

Learn more about On-demand DAST

按需 DAST 扫描的站点配置文件

通过按需 DAST 扫描快速重用配置文件,而不是每次需要运行时重新配置。将不同的扫描配置文件与站点配置文件混合,以快速执行涵盖应用程序和 API 不同区域或不同深度的扫描。

Learn more about application security for containers