ThreadFix Integrations

Snyk is the leader in developer security. We empower the world’s developers to build secure applications and equip security teams to meet the demands of the digital world. Our developer-first approach ensures organizations can secure all of the critical components of their applications from code to cloud, leading to increased developer productivity, revenue growth, customer satisfaction, cost savings and an overall improved security posture. Snyk is a developer security platform that automatically integrates with a developer’s workflow and is purpose-built for security teams to collaborate with their development teams.

Jenkins, the most popular open-source automation server, provides hundreds of plugins that can be used to build, deploy, and automate any project. Jenkins is an extensible automation server that can be used to create CI servers or become the continuous delivery hub for any project. Jenkins is a Java-based program that can be run straight out of the box. It includes packages for Windows, Linux and macOS, as well as other Unix-like operating system packages. Jenkins is easy to set up and configure via its web interface. It also includes built-in help and on-the-fly error checking. Jenkins can be integrated with almost every tool in the Continuous Integration and Continuous Delivery toolchain thanks to the hundreds of plugins available in the Update Center. Jenkins' plugin architecture allows for almost unlimited possibilities. Jenkins makes it easy to distribute work across multiple machines. This helps drive builds, tests, and deployments across multiple platforms more quickly.

SonarQube Server is a robust, self-hosted solution that allows development teams to continuously monitor and enhance code quality and security. It offers automated static analysis for a wide array of programming languages, helping teams detect bugs, vulnerabilities, and inefficiencies early in the development process. With SonarQube Server, users can seamlessly integrate code quality checks into their CI/CD workflows, whether on-premises or in the cloud. The platform provides detailed, actionable reports that help teams reduce technical debt, improve maintainability, and uphold coding standards across projects. Ideal for organizations looking for complete control over their code quality processes, SonarQube Server supports scalability and customization to meet enterprise needs.

Mend.io’s enterprise suite of app security tools, trusted by leading companies such as IBM, Google and Capital One, is designed to help build and manage an mature, proactive AppSec programme. Mend.io is aware of the AppSec needs of both developers and security teams. Mend.io, unlike other AppSec tools that force everyone to use a unified tool, helps them work together by giving them different, but complementary tools - enabling each team to stop chasing vulnerability and start proactively management application risk.

Bugzilla is server software that helps you manage software development. Optimized database structure for improved performance and scalability High security to protect confidentiality. Advanced query tool that can save your searches. Integrated email capabilities. You can edit your user profile and set up email preferences. Comprehensive permissions system. As Mozilla's bug tracking system, it has been criticized. Bugzilla is used by many companies, organizations, projects, and individuals. This page features a few high-profile installations and other interesting installations. It also includes a list public Bugzillas. This page contains bug fixes and performance enhancements only. There are no new features or large-scale performance improvements. No database schema changes. May contain documentation changes. Templates that aren't part bug fix will not be modified, except for typos and grammatical corrections.

Invicti (formerly Netsparker) dramatically reduces your risk of being attacked. Automated application security testing that scales like none other. Your team's security problems grow faster than your staff. Security testing automation should be integrated into every step in your SDLC. Automate security tasks to save your team hundreds of hours every month. Identify the critical vulnerabilities and then assign them to remediation. Whether you are running an AppSec, DevOps or DevSecOps program, help security and development teams to get ahead of their workloads. It's difficult to prove that you are doing everything possible to reduce your company's risk without full visibility into your apps, vulnerabilities and remediation efforts. You can find all web assets, even those that have been forgotten or stolen. Our unique dynamic + interactive (DAST+ IAST) scanning method allows you to scan the corners of your apps in a way that other tools cannot.

More than 30,000 organizations around the world trust Nessus as the most widely used security technology on the planet. It is also the gold standard in vulnerability assessment. Since the beginning, we have worked closely with the security community. Nessus is continuously optimized based on community feedback in order to provide the best vulnerability assessment solution available. Twenty years later, we are still focused on community collaboration and product innovations to provide the most complete and accurate vulnerability data. This will ensure that you don't miss critical issues that could expose your organization's vulnerabilities. Today, Nessus has been trusted by over 30,000 organizations around the world as the best vulnerability assessment tool and security technology.

Jira is a project management tool that allows you to plan and track the work of your entire team. Atlassian's Jira is the #1 tool for software development teams to plan and build great products. Jira is trusted by thousands of teams. It offers a range of tools to help plan, track, and release world-class software. It also allows you to capture and organize issues, assign work, and follow team activity. It integrates with leading developer software for end-toend traceability. Jira can help you break down big ideas into manageable steps, whether they are small projects or large cross-functional programs. Organize your work, create milestones and dependencies, and more. Linking work to goals allows everyone to see how their work contributes towards company objectives, and to stay aligned with what's important. Your next step, suggested by AI. Atlassian Intelligence automatically suggests tasks to help you get your big ideas done.

Security Solutions for Your DevOps Process Automate scanning your code to find and fix vulnerabilities. Kiuwan Code Security is compliant with the strictest security standards, such OWASP or CWE. It integrates with top DevOps tools and covers all important languages. Static application security testing and source analysis are both effective, and affordable solutions for all sizes of teams. Kiuwan provides a wide range of essential functionality that can be integrated into your internal development infrastructure. Quick vulnerability detection: Simple and quick setup. You can scan your area and receive results in minutes. DevOps Approach to Code Security: Integrate Kiuwan into your Ci/CD/DevOps Pipeline to automate your security process. Flexible Licensing Options. There are many options. One-time scans and continuous scanning. Kiuwan also offers On-Premise or Saas models.

Get enterprise agile management. All levels of the organization can be unified and empowered to create and deliver great software. This system is designed from the ground up to support agile and lean software development. Scale up and down across projects, workspaces, portfolios, locations, and teams. Automate decision-making insight across your entire software lifecycle. Engage with your team members across the organization. Agility lets you tap the potential of your people's knowledge, processes, tools, and skills. It can be used across your enterprise to engage stakeholders and help you identify business and product issues and improve software quality. Agility supports Scrum and Kanban, XP and SAFe® hybrid development methodologies. It makes it easier for all teams, programs, portfolios and the enterprise to plan, track and report on their activities.

HCL AppScan for Application Security Testing. To minimize attack exposure, adopt a scalable security test strategy that can identify and fix application vulnerabilities at every stage of the development process. HCL AppScan provides the best security testing tools available to protect your business and customers from attack. Rapidly identify, understand, and fix security vulnerabilities. App vulnerability detection and remediation is key to avoiding problems. Cloud-based application security testing suite for performing static, dynamic, and interactive testing on web and mobile. Multi-user, multiapp dynamic application security (DAST), large-scale, multiuser, multi-app security for applications (DAST), to identify, understand, and remediate vulnerabilities and attain regulatory compliance.

Acunetix is the market leader for automated web application security testing and is the preferred tool for many Fortune 500 customers. Acunetix can detect and report on a wide range of web application vulnerabilities. Acunetix's industry-leading crawler fully supports HTML5/JavaScript and Single-page applications. This allows auditing of complex, authenticated apps. Acunetix is the only technology that can automatically detect out of-band vulnerabilities. It is available online as well as on-premise. Acunetix includes integrated vulnerability management capabilities to help enterprises manage, prioritize and control all types of vulnerability threats. These features are based on business criticality. Acunetix is compatible with popular Issue Trackers, WAFs, and is available online on Windows, Linux, and Online

Integrated software delivery tools hosted on premisis allow you to share code, track work and ship software. You can use all Azure DevOps services, or only the ones that you need to enhance your existing workflows. Azure DevOps Server, formerly known as Team Foundation Server (TFS), is a collection of software development tools that can be used together. It is hosted on-premises. Azure DevOps Server can integrate with your existing editor or IDE, allowing your cross-functional team members to work efficiently on projects of any size. Azure DevOps Server is source code management software, and includes features such as access Controls/Permissions, bug tracking, build automation, change management, code review, collaboration, continuous integration, and version control.

Digitize your workflows and they will love you for it. Your company will be more productive and your employees more engaged. ServiceNow makes work more enjoyable for employees. ServiceNow transforms old, manual ways to work into modern digital workflows so customers and employees get what they need when they need it. It's fast, simple, and easy. ServiceNow provides digital workflows that deliver great experiences and increase productivity for employees and enterprises. ServiceNow simplifies the complexity of work with a single enterprise cloud platform. The Now Platform: An intelligent, intuitive cloud platform that allows you to work smarter. You can choose from our workflows, or create your own apps. Our product portfolio is built on the Now Platform and delivers the IT, Employee, Customer, and Customer Workflows that matter. We also offer enterprise solutions to help you drive every aspect of your digital transformation. Get the amazing experiences you desire and unlock the productivity that you need. Now, native mobile capabilities are available for every day work across the enterprise.

IriusRisk is an open Threat Modeling platform that can be used by any development and operations team – even those without prior security training. Whether your organization follows a framework or not, we can work with all the threat modeling methodologies, such as STRIDE, TRIKE, OCTAVE and PASTA. We support organisations in financial services, insurance, industrial automation, healthcare, private sector and more. IriusRisk is the industry's leading threat modeling and secure design solution in Application Security. With enterprise clients including Fortune 500 banks, payments, and technology providers, it empowers security and development teams to ensure applications have security built-in from the start - using its powerful threat modeling platform. Whether teams are implementing threat modeling from scratch, or scaling-up their existing operations, the IriusRisk approach results in improved speed-to-market, collaboration across security and development teams, and the avoidance of costly security flaws.

Black Duck, a part of the Synopsys Software Integrity Group, provides industry-leading application security testing (AST) solutions. Their suite of tools includes static analysis, software composition analysis (SCA), dynamic analysis, and interactive analysis, enabling organizations to detect and address security vulnerabilities throughout the software development lifecycle. Black Duck specializes in automating the discovery and management of open-source software, ensuring compliance with security standards and licensing requirements. By integrating seamlessly into development workflows, Black Duck helps businesses manage application security, quality, and compliance risks efficiently. Their solutions empower organizations to innovate with confidence, delivering secure and reliable software at the speed of modern business.

PortSwigger brings you Burp Suite, a leading range cybersecurity tools. Superior research is what we believe gives our users a competitive edge. Every Burp Suite edition shares a common ancestor. Our family tree's DNA is a testament to decades of research excellence. Burp Suite is the trusted tool for your online security, as the industry has proven time and again. Enterprise Edition was designed with simplicity in mind. All the power of Enterprise Edition - easy scheduling, elegant reports, and straightforward remediation advice. The toolkit that started it all. Discover why Burp Pro is the preferred tool for penetration testing for over a decade. Fostering the next generation of WebSec professionals, and promoting strong online security. Burp Community Edition allows everyone to access the basics of Burp.

The NTT Application Security Platform offers all the services necessary to protect the entire software development cycle. We help organizations reap the benefits of digital transformation without worrying about security. Be smart about application security. Our application security technology is the best in its class. We constantly scan your code and detect attack vectors. NTT Sentinel Dynamic identifies and verifies all vulnerabilities in websites and web applications. NTT Sentinel Source, NTT Scout scans your entire source code and identifies vulnerabilities. They also provide remediation advice and detailed vulnerability descriptions.

Today, Security Compass is a pioneer in application security that enables organizations to shift left and build secure applications by design, integrated directly with existing DevSecOps tools and workflows. To better understand the benefits, costs, and risks associated with an investment in SD Elements, Security Compass commissioned Forrester Consulting to interview four decision-makers with direct experience using the platform. Forrester aggregated the interviewees’ experiences for this study and combined the results into a single composite organization. The decision-maker interviews and financial analysis found that a composite organization experiences benefits of $2.86 million over three years versus costs of $663,000, adding up to a net present value (NPV) of $2.20 million and an ROI of 332%. Security Compass is the trusted solution provider to leading financial and technology organizations, the US Department of Defense, government agencies, and renowned global brands across multiple industries.

Coverity Static Analysis is a robust code scanning solution designed to help developers and security teams deliver secure, high-quality software while meeting critical security, functional safety, and industry standards. It detects and resolves complex defects across extensive codebases, identifying issues that span multiple files and libraries to improve both security and code quality. Coverity supports a wide range of compliance standards, including OWASP Top 10, CWE Top 25, MISRA, and CERT C/C++/Java, offering built-in reporting to track, prioritize, and address issues effectively. With the Code Sight™ IDE plugin, developers receive real-time results, CWE insights, and remediation guidance directly within their development environment, integrating security seamlessly into their workflow. Its scalable design handles large codebases across various programming languages, making it an essential tool for modern software development. By embedding security and quality checks early in the software development lifecycle, Coverity helps organizations reduce risk, accelerate delivery, and maintain compliance with industry regulations.

You can better understand the risks in your current environment and work with technical teams. InsightVM's shared view and common language can bring together traditionally siloed groups and help drive impact. You can take a proactive approach to security by tracking and establishing metrics that will help you track progress and create accountability. InsightVM not only provides visibility into the vulnerabilities in your modern IT environment--including local, remote, cloud, containerized, and virtual infrastructure--but also clarity into how those vulnerabilities translate into business risk and which are most likely to be targeted by attackers. InsightVM isn't a magic bullet. It provides the shared view and common language that are needed to bring together traditionally siloed groups and drive impact. It supports proactive vulnerability management through tracking and metrics that provide accountability for remediators, demonstrate the impact across teams, celebrate progress, and encourage celebrations.

Find and fix security problems early with the most accurate results available in the industry. The OpenText™, Fortify™, Static Code Analyzer pinpoints security vulnerabilities, prioritizes issues that are most serious, and provides detailed instructions on how to fix these. A centralized software security manager helps developers resolve issues faster. Support for 1,657 vulnerabilities categories in 33+ languages and more than 1 million APIs. Fortify's integration platform allows you to embed security into the application development tools that you use. Audit Assistant allows you to control the speed and accuracy SAST scans by adjusting the depth and minimizing false-positives. Scale SAST scans dynamically up or down in order to meet the changing needs of the CI/CD pipe. Shift-left security is achieved in a single solution for cloud-native apps, from IaC through to serverless.

Tenable One unifies security visibility and insight across the attack surface. This allows modern organizations to isolate and eliminate priority cyber exposures, from IT infrastructure, cloud environments, critical infrastructure, and everywhere else. The only AI-powered exposure platform in the world. Tenable's leading vulnerability management sensors allow you to see every asset on your entire attack surface, from cloud environments to operational technology, infrastructure to containers and remote workers to web-apps. Tenable's machine learning-powered predictions, which include more than 20 trillion aspects related to threat, vulnerability and misconfiguration information, reduce remediation effort by allowing you to focus on the most important risks. By communicating objective measures of risks, you can drive improvements to reduce the likelihood of a business impacting cyber event occurring.

Brakeman is a security scanner for Ruby on Rails applications. Brakeman scans your application's source code, which is a different approach to other web security scanners. Brakeman does not require you to set up your entire application stack in order to use it. Brakeman scans your application code and generates a report detailing all security issues found. Once Brakeman is installed, it doesn't require any configuration or setup. Simply run it. Brakeman is a program that only requires source code. You can create a new application using rails new and then run Brakeman to check it. Brakeman doesn't rely on spidering sites for all pages. This allows it to provide a more comprehensive coverage of an application. This includes pages that may not yet be live. Brakeman can detect security flaws before they are exploitable. Brakeman was specifically designed for Ruby on Rails applications. It can check configuration settings for best practice.

Seeker® is an interactive application security testing (IAST) solution that delivers deep visibility into the security posture of web applications. It identifies and analyzes vulnerabilities against industry standards such as OWASP Top 10, PCI DSS, GDPR, CAPEC, and CWE/SANS Top 25, ensuring compliance and robust protection. Seeker tracks sensitive data usage, verifying it is handled securely and not stored improperly in logs or databases without encryption. Seamlessly integrating into DevOps CI/CD workflows, it enables continuous security testing without disrupting development processes. Unlike traditional IAST solutions, Seeker not only identifies vulnerabilities but also verifies their exploitability, providing developers with a prioritized list of actionable issues. By leveraging patented methods, it processes large volumes of HTTP(S) requests with precision, reducing false positives to near zero. Additionally, Seeker enhances team collaboration with detailed reporting and remediation guidance, ensuring security is addressed effectively across the software development lifecycle.

Automated dynamic application security testing can help you find and fix web application vulnerabilities. Automated dynamic analysis of web applications and APIs can detect exploitable vulnerabilities. Support for the most recent web technologies and pre-configured policies to comply with major compliance regulations. High-powered scanning integrations allow API and single page application testing at scale. Automation and workflow integrations are key to meeting the DevOps needs. Monitoring trends and dynamic analysis are two of the ways to identify vulnerabilities. With custom scan policies and incremental support, you can achieve fast and focused results. AppSec programs should be built around solutions and not just products. Fortify's single taxonomy can be used for SAST (DAST), IAST, RASP, and DAST. WebInspect is the industry's most advanced dynamic web application testing tool, providing the coverage required to support both modern and legacy applications.

During code review, you can find critical performance, reliability, or security bugs that are easiest to fix. Sonatype Lift is a cloud-native code analysis platform that's collaborative and built for developers. It analyzes every developer pull request to identify and fix security, reliability, style, and reliability issues. Then, it reports them as comments to code review where they are 70x more likely get fixed. The first deep code analysis tool that focuses on code quality will elevate your development. Sonatype Lift is a part of the development process. It analyzes, reports, and provides feedback on bugs in the same way as your peers in peer code review. It is compatible with the existing development environments such as Bitbucket, GitLab, and GitHub. The Lift-bot instantly reports any pull request with vulnerability and bug information. One tool allows you to go beyond traditional linting to deeper analysis of interprocedural codes.

OpenText ALM Quality Center is a single-pane-of-glass for software quality management. It helps you implement rigorous and auditable lifecycle process and govern application lifecycle activities. Use the reusability and traceability of ALM tools, as well as their automation, to improve efficiency when developing, testing and maintaining applications. Automate the collection of results and gain real-time insight into application quality by eliminating time-consuming, error-prone manual processes. Standardize processes with templates and workflows built into ALM. Ensure compliance through detailed change tracking, a risk-based strategy and detailed change tracking. Integrate and use APIs to create a vendor-neutral, automated ecosystem for data consolidation throughout your application lifecycle. Choose the deployment option that best meets your needs for scalability and security.

Qualys TruRisk Platform, formerly Qualys Cloud Platform. The revolutionary architecture behind Qualys IT, security and compliance cloud apps. Qualys TruRisk Platform provides a continuous, always on assessment of your global security, compliance, and IT posture. You can see all your IT assets in 2 seconds, no matter where they are located. With automated, built in threat prioritization and patching, as well as other response capabilities, this is a complete end-to-end solution. Qualys TruRisk Platform sensor are always active, whether on premises, endpoints, mobile, containers, or in the cloud. This gives you continuous visibility of your IT assets in just 2 seconds. The sensors are self-updating and centrally managed, they can be remotely deployed, and they can also be virtual appliances or lightweight agents. Qualys TruRisk Platform is an end-toend solution that allows you to avoid the costs and complexity of managing multiple security vendors.

This customizable database workflow application development and production software provides greater visibility and control over the entire software development lifecycle. ClearQuest®, a change management software from IBM®, Rational®, ClearQuest®, helps to improve developer productivity and adapt the processes, tools, and methodologies that best suit the project and the people in the team. This software offers tools and processes that enable you to keep control of changes while meeting the varied needs of developers. IBM also offers a new bundle offering under a new consumption plan that changes how you can use and deploy DevOps Software. This new offering simplifies your planning for the adoption and growth important IBM DevOps products. You can collaborate with your team members in near real time using customizable process automation and enforcement to ensure effective communication, reporting, and insights.

This new type of security is specifically designed to protect software. Integrate security into your toolchain to resolve security issues within minutes of installation. Developers can now find and fix vulnerabilities by using Contrast agents, which monitor code and report directly to security experts. Security teams can now focus on governance, instead of worrying about code monitoring. Contrast Assess deploys a smart agent that instruments the application using smart sensors. The code can be analyzed from within the application in real-time. Instrumentation reduces false positives that can slow down security teams and developers. Integrating security into your toolchain will help you resolve security issues quickly. Contrast Assess seamlessly integrates into the software lifecycle and into the tool sets that developers and operations teams already use, including native integration to ChatOps, ticketing system and CI/CD tools and a RESTful API.

Zed Attack Proxy is a free and open-source penetration test tool that is being maintained under the wing of the Open Web Application Security Project. ZAP is flexible and extensible and was specifically designed for testing web applications. ZAP is a "man in the middle proxy" that acts as a firewall between the browser and the web app. It can intercept and inspect the messages between the browser and web applications, modify them if necessary, and then forward those packets to the destination. It can be used both as a standalone application and as a daemon process. ZAP offers functionality for all skill levels, from developers to security testers, to security specialists, to security testers who are new to security testing. ZAP supports all major OSes and Dockers, so you don't have to stick with one OS. You can access additional functionality from the ZAP Marketplace by downloading add-ons.

Are you at risk for a hacker? To find out if you software is vulnerable to open-source vulnerabilities, try the Nexus Vulnerability Scanner. The Nexus Vulnerability Scanning will generate a Software Bill of Materials, which lists all components of your application. Your results will show you any policy violations, security issues, and a license analysis. This will help you understand your open source risk. Your company will need start to fix known vulnerabilities and secure your application against possible hacks. Learn more about Sonatype.

Veracode provides a holistic and scalable solution to manage security risk across all your applications. Only one solution can provide visibility into the status of all types of testing, including manual penetration testing, SAST, DAST and SCA.

Automate privacy and security testing for mobile apps that you create and use from one portal. You can test pre-prod or published iOS/Android binaries and monitor the apps that power your workforce with NowSecure Platform. Automated security and privacy testing of mobile binaries to scale Agile and DevOps software development. To ensure that your apps are in production, you can build bridges between dev, security and GRC teams. Modern testing processes can be streamlined. The NowSecure Platform was designed to meet the complex needs of modern mobile SDLC. It provides security and privacy testing solutions that are continuous, customizable, accurate, and reliable. Accurate results allow for maximum visibility across all teams.