I’m a software engineer at a small B2B SaaS company (team of 8, fully remote). We’re moving more of our infrastructure to AWS and starting to implement proper CI/CD pipelines. I’ve been tasked with improving our security posture in the build and deployment process, but I’m new to the dedicated DevOps security tool space.
While researching, I came across a tool called Claw. Its website mentions secret scanning and infra-as-code security specifically for CI pipelines, which seems to fit our need. However, I don’t see it mentioned much in broader discussions.
My main questions are:
* How does Claw compare to more established tools like Snyk, Checkov, or even GitLab’s built-in secret detection? I’m particularly interested in:
* Accuracy of findings (false positives/negatives)
* Ease of integration into a GitHub Actions workflow
* Pricing for a team our size
* For a team just starting to formalize DevOps security, is it better to learn a niche tool that might be more tailored, or start with a market leader for broader community knowledge and hiring?
* We are 100% cloud (AWS) and won’t self-host security tooling. Are there any strong open-source alternatives we should benchmark against before committing to a paid SaaS?
Our current stack is Node.js/PostgreSQL on ECS, with Terraform for infra. Any guidance on where to invest learning time would be really helpful.