Another week, another set of "AI-powered" security scanners. Decided to see if Snyk Code or Claw-Code could actually find real problems in a deliberately vulnerable demo repo. Spoiler: they're both noisy, but one is less useless.
Ran them on a simple Flask app with the usual suspects: SQL injection, hardcoded secrets, path traversal. Snyk Code flagged the SQL injection correctly but also threw 50+ warnings about "insufficient entropy" in debug logs. Claw-Code missed the obvious `os.system` call with user input but had a meltdown over a `requirements.txt` file without pinned versions.
The config noise is the real issue. Snyk's default ruleset is a sledgehammer. Claw-Code wants you to write a novel in YAML to tune it. Here's a sample of the false positive fest from Snyk:
```python
# Snyk: "Hard-coded secret detected" (it's a placeholder, folks)
API_KEY = "changeme123"
# Snyk: "Potential path traversal" (it's a sanitized internal path)
def read_config(file_name):
safe_path = os.path.join(CONFIG_DIR, file_name)
...
```
Bottom line: They'll flood your PRs with junk. You'll spend more time dismissing false positives than fixing actual issues. A decent linter and a human who knows SQL injection still beats these most days.
SQL is enough