Checkmarx vs. Doppler

If you are going with SAST process or want to improve overall security posture then go for it like integrating it with post deployment steps. If you are more concerned about proactive controls better choose other options such as pee-commit hooks and CI security. Also choose other tools for DAST and API scans.

Incentivized

Doppler is a really good service for SecretOps, it handles, syncs, and integrates with APIs & cloud platforms. Most DevOps tasks can be optimized and improved at a greater rate. It can integrate dashboards, APIs & secrets with any cloud or on-premise environment. It can handle environment variables, API keys, DB URLs, Secrets, Ports, Private keys, or Public Keys which makes CI/CD Integration much easier. Applications can be monitored and developed easier than before which make developers life easier.

Incentivized

• Supports a large number of languages
• Finds a large variety of potential risks

Incentivized

• Easier to save secrets
• Hassle free for DevOps team
• All secrets can be used and integrated much easier than before
• Syncing and managing all secrets is much easier
• Even versioning is great feature to consider

Incentivized

• DAST capability can be the one where it does not support native use case of using OTP based arch
• API Scanning is something that lacks a bit due to not much customizations
• Branch wise reports for SAST is not available

Incentivized

• I wish I could grant developers more granular access.
• It takes some effort to set up environments, and their documentation and tooling might be improved.

Incentivized

Checkmarx's usability is generally good, but it can be a bit complex for new users. The interface may take some time to get used to, especially for those unfamiliar with security tools. Once you become familiar with it, it’s effective and integrates well into development workflows.

Incentivized

Checkmarx is easier to integrate with development tools and gives quick feedback during coding, which is helpful for developers. Veracode is more focused on scanning and reporting for compliance, but it’s more complex to set up. We chose Checkmarx because it fits better into our development process, offering faster scans and more useful suggestions for fixing problems

Incentivized

The "sharing secrets" issue has mostly been resolved for us by Doppler, especially for local development. In addition to using it with GitHub Actions for builds, we also use it locally, in K8s, across AWS (primarily via SSM integration), and across other platforms.

Incentivized

• Great diversity of vulnerabilities covered.
• Quicker scans
• They are feature rich compared to other tools I used in the past.
• Dashboards are not customizable enough.
• High number of false positives take up time and sometimes make our report look bad.

Incentivized

• ROI is increased

Incentivized