AppSec tool stack recommendations from security engineers

Hey everyone! I've been refining our AppSec pipeline at work and wanted to share what we're using, hoping to get your thoughts and recommendations too. We're a mid-sized team running mostly containerized apps on AWS with a GitHub Actions CI/CD pipeline.

Our main goals were shifting security left without drowning devs in alerts, and having clear ownership (security team writes the rules, devs fix their own code). Here's our current stack:

**Pre-Commit & SAST:**
- **Trivy** for container and filesystem vulnerability scanning. We run it in CI against our Dockerfiles and built images. The SBOM generation is a nice bonus.
- **Semgrep** for static analysis. We found it easier to write custom rules for our frameworks compared to some heavier tools. The performance is great.
- **Gitleaks** as a pre-commit hook and in CI for secret scanning. It's been incredibly effective at catching accidental commits.

**SCA & Dependencies:**
- **Dependabot** (native to GitHub) for automated dependency PRs. We've tuned it to only flag high/critical severity for certain repos.
- We evaluate **Renovate** periodically for more configurability, but Dependabot's simplicity wins for now.

**Infrastructure as Code:**
- **Checkov** for scanning our Terraform plans. It catches a lot of misconfigured S3 buckets and IAM policies early.
```hcl
# Example of a rule it caught: an S3 bucket without versioning enabled
resource "aws_s3_bucket" "example" {
bucket = "my-app-logs-bucket"
# checkov:skip=CKV_AWS_21: "Ensure all data stored in the S3 bucket have versioning enabled"
# We actually had to justify this skip in a PR comment!
}
```

**Runtime & Observability:**
- **Falco** on our EKS clusters for runtime threat detection. Alerts go to our security Slack channel.
- Centralized logging (Amazon OpenSearch) with dashboards for security events.

I'm particularly curious about:
1. **DAST tools** – we're looking at OWASP ZAP in the pipeline, but are there lighter-weight options you love?
2. **Software Bill of Materials (SBOM)** – how are you managing and distributing these beyond just generating them?
3. **Container signing** – are you using Cosign, Notary, or something else for supply chain integrity?

What's in your stack that you'd swear by, especially for cloud-native setups? Any tools you tried and abandoned?

-- Amy