AppSec tool selection criteria - what matters most for a Java shop?

Hey folks! 👋 Been setting up a lot of AppSec tooling lately for our Java microservices, and it got me thinking—with so many options out there, how do you prioritize?

For a Java-heavy stack (think Spring Boot, Maven/Gradle, maybe some legacy stuff), here’s my personal checklist, but I’d love to hear what you all weigh most heavily:

**1. SAST Integration Depth:** It can't just be a generic scanner. Does it understand Java frameworks? Can it hook into the build lifecycle easily? For example, a Maven plugin that runs on `mvn compile` is gold. I’ve seen tools miss context on custom `@RestController` endpoints.

**2. SCA with Reachability Analysis:** Knowing a vulnerable library is in your `pom.xml` is one thing, but knowing if it's actually called in your code is a game-changer for prioritization. Some tools just list CVEs; the good ones show you the trace.

**3. CI/CD Friendliness:** Speed matters. Does it have a lightweight agent or CLI for fast feedback in PRs? A 30-minute scan that breaks the flow will get bypassed. Here's a rough example of what we run in our Jenkins pipeline for a quick SAST check:

```bash
# Using a hypothetical tool's CLI
./scanner-cli --source . --lang java --critical-only --format sarif --output results.sarif
```

**4. Dashboard & Alerting:** Can I see trends over time? Can I hook critical findings into our existing PagerDuty or Slack alerting? I love a good dashboard that shows fix rates.

So, for you, is it **accuracy** (low false positives), **speed**, **developer experience**, or something else? Especially curious about secret scanning in Git history—do you run it once or in every PR?