Code Sight glossary

A security level reported by certain Coverity checkers and by Rapid Scan Static scans. This level appears as an ‘A’ icon in the Code Sight Issues list.

The Audit level reports data-source or code patterns that might indicate an exploit, but where the evidence of a vulnerability is incomplete.

The family of Black Duck software composition analysis (SCA) engines.

The short name of the Black Duck IDE plug-in for code analysis.

The family of Black Duck static analysis engines.

The Coverity component that analyzes source code to detect quality, security, and other issues.

(The alternative static analysis engine is Rapid Scan Static.)

A server-based application that manages the database of issues reported by Coverity Analysis.

Using Coverity Connect is one option for synchronizing local data with remote data (the other option is a Coverity on Polaris server).

A server-based application that manages the database of issues reported by Coverity Analysis.

Using Coverity on Polaris is one option for synchronizing local data with remote data (the other option is Coverity Connect).

Short for Black Duck® Detect. The Black Duck component that runs on a client system. Detect can launch scans, manage scan files, and communicate with a Black Duck server.

Techniques for testing program code by executing the program and analyzing outcomes.

For Coverity, a full scan provides summaries of findings obtained by scanning the source files within a project. Full scans provide information about dependencies in the current source file: This information improves the accuracy—and hence, the usefulness—of the single-file scan.

When not connected to a server, you need to run a full scan locally. You can do this from the Code Analysis panel.

When connected to a Coverity server, Code Sight downloads the results when a full scan completes on that server. Often a server will be set up to launch scans automatically, as part of a CI/CD build chain.

A situation found in source code that might be problematic, and so is reported by one of the Black Duck software integrity engines that Code Sight runs.

A cloud-based platform that delivers highly scalable Static Application Security Testing (SAST) and Software Composition Analysis (SCA).

The engine that performs software composition analysis (SCA). This engine is powered by Black Duck® Detect.

An engine to perform static analysis quickly. This engine is powered by Sigma.

(The alternative static analysis engine is Coverity Analysis.)

Stands for static application security testing, another term for static analysis.

Stands for software composition analysis.

A Black Duck analysis engine that Rapid Scan Static uses to analyze source code and text-based metadata.

The analysis of a project or code base to identify and assess its component software and its setup. In particular, software composition analysis (SCA) is used to identify open source software components, and the security risks attendant on their use.

A complete application security posture management (ASPM) solution. SRM enables you to set up policy-driven workflows to orchestrate application security testing tools such as Coverity and Black Duck, prioritize issues, and monitor compliance across your software assets.

Techniques for testing program code without executing the program. Also known as static application security testing (SAST).

The full name of the Black Duck IDE plug-in for code analysis.