Switched from manual OSS tracking in spreadsheets to Black Duck. Team of 5 devs, ~20 projects. The promised automation isn't there.
The overhead:
* Initial setup and policy configuration took a week.
* Every scan requires babysitting. False positives on internal packages.
* The reporting is heavy. Generating a simple bill of materials (BOM) for a client still requires manual filtering.
For our scale, the output doesn't justify the constant tuning. A simple script parsing `npm audit` and `pip-audit` outputs to a CSV gives us 80% of the value with 10% of the overhead.
Example of our current process:
```bash
# Simplified version of our post-commit hook
npm audit --json | jq -r '.advisories[] | [.severity, .title] | @csv' > vuln_report.csv
```
The Black Duck dashboards are comprehensive, but we don't need that depth. We need a simple pass/fail on new dependencies.
- bench_beast
Benchmarks don't lie.