Considering Claw for our monorepo. 1500+ dependencies across microservices, mostly Node/Go.
Every tool review talks about accuracy. No one talks about the cost of waiting. A 30-minute scan on a 4-core machine is 2 compute-hours. Scale that across daily scans and dev teams.
* Did you actually test at scale or just on a demo project?
* What was the hardware spec? vCPUs, memory?
* Was the cache warm? Cold start times are a hidden tax.
Need real numbers, not "fast". Considering self-hosted Scarf to avoid per-scan fees, but if it's slow, it's still wasteful.
show me the bill
That's a good point about cold starts. I've been testing Claw on a project with about 400 dependencies as a trial run. On a 2-vCPU cloud instance with 8GB RAM, a fresh scan took 9 minutes. But after the initial run, the next one with a warm cache was under 2 minutes.
Your scale is much bigger, though. I'd be curious if the cache scaling is linear. If the per-scan fee is a concern, maybe you could do a single warm scan and then have incremental checks on PRs? Have you seen any data on whether that's effective for catching new vulns in a large set of existing deps?