What Codacy is
Codacy is a code quality and scanning toolbox similar to SonarQube for code scanning. They support many languages via open source scanning tools and have a developer focus. The vendor site is www.codacy.com. This profile is an entry in the oneNorma directory, not a vendor landing page.
What Codacy covers
Codacy is in the catalog for these capabilities. Categories: ASPM, SAST, SCA, DAST, Secret Scanning, and IaC. Catalog tags: Hands-on and Best for Startups.
How to evaluate Codacy in a security program
Use Codacy as a stack candidate, not as diligence evidence. The oneNorma score for Codacy is 4.5/10 (percentile 27). If the real gap is in ASPM, SAST, SCA, DAST, Secret Scanning, and IaC, a dashboard does not replace a pentest or a control mapped to Law 21.663 or ISO 27001. Compare this profile with what www.codacy.com publishes. Contrast it with pentesting and Security Cloud & Compliance.