Coverity
Ranked 7 of 12 static analyzers by recommenders
People recommend it for finding real bugs in C and C++ code, and it is free for open source projects. Critics say its reports contain many false positives.
People recommend it for finding real bugs in C and C++ code, and it is free for open source projects. Critics say its reports contain many false positives.
13 people gave an opinion
- recommend it
- 7
- criticize it
- 6
- approval share
- 54%
Recommended in 4 of 13 months
- November 2025: recommended
- December 2025: not recommended
- January 2026: recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: not recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: not recommended
- October 2026: recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 7 people recommend itNeeds 10 or more, not met.
- 1.1 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 4 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Finds real bugs in C
“a 15 year old copy of Fortify or CoVerity could find bugs mythos missed”
Comment from 19 May 2026 in “Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised” “Coverity is pretty good about finding these kinds of bugs”
Comment from 2 Nov 2025 in “X.org Security Advisory: multiple security issues X.Org X server and Xwayland”
What people warn about
Each mark is one comment
Many false positives in reports
“resulted in a colossal number of false positives”
Comment from 7 May 2026 in “Mozilla says 271 vulnerabilities found by Mythos and "almost no false positives"” “generated far more false positives than substance”
Comment from 2 Oct 2026 in “Vote on which of Hacker News' challenges for AI have been met” Hard to use reports and tooling
“everyone hated how stupid and annoying the tooling was”
Comment from 3 Oct 2026 in “Greg Kroah-Hartman – Security in the LLM Age [video]” “less straining than trying to parse a Coverity report”
Comment from 8 Jun 2026 in “LLMs are eroding my software engineering career and I don't know what to do” Reports weaker than newer tools
“The Coverity reports aren't anything like that. These tools aren't remotely in the same league or even universe.”
Comment from 7 May 2026 in “Mozilla says 271 vulnerabilities found by Mythos and "almost no false positives"” “it's just sad that Coverity represents the best working C++ static analysis tool”
Comment from 7 May 2026 in “Mozilla says 271 vulnerabilities found by Mythos and "almost no false positives"”
Other static analyzers people recommend
The four most recommended other static analyzers, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| zizmor | 19 | 1 | 95% | 6 | — | Approved |
| Semgrep | 14 | 10 | 58% | 7 | — | — |
| clang-tidy | 14 | 4 | 78% | 6 | — | Approved |
| PHPStan | 11 | 0 | 100% | 7 | — | Approved |
| CoverityThis page | 7 | 6 | 54% | 4 | — | — |
What people said
11 of the 13 comments that mention it, newest first. Each links to the original comment.
“If the goal is language subsetting, they do the job just fine.”
“everyone hated how stupid and annoying the tooling was”
“also found many useful bugs with their code analyzer but had a much smaller false positive rate”
“generated far more false positives than substance”
“less straining than trying to parse a Coverity report”
“a 15 year old copy of Fortify or CoVerity could find bugs mythos missed”
“Coverity scans several open source projects for free.”
“resulted in a colossal number of false positives”
“it's just sad that Coverity represents the best working C++ static analysis tool”
“The Coverity reports aren't anything like that. These tools aren't remotely in the same league or even universe.”
“Coverity is pretty good about finding these kinds of bugs”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.