Hi everyone, I'm diving into open source license compliance and security scanning for the first time at my job. We have a pretty large React monorepo (using npm workspaces) and my manager asked me to look into FOSSA, Snyk, and Black Duck to pick one.
I've been reading docs and doing some trials, but I'm getting a bit lost in the specifics. I know they all do SBOMs and vulnerability scanning, but the practical differences for a modern JS/TS stack aren't super clear to me from the marketing pages.
For example, our main needs are:
* Good monorepo support (scanning the root and each package correctly).
* Clear license compliance reports, especially for React and its ecosystem dependencies.
* Fix guidance that actually works for npm/yarn.
* A CLI we can integrate into our CI (GitHub Actions).
I tried the FOSSA CLI locally and got this basic setup:
```bash
# In the repo root
npm install -g @fossa/cli
fossa init
fossa analyze
```
It generated a dependency graph, but I'm not sure how deep it went into nested workspaces. Snyk's `snyk test --all-projects` seemed to handle that structure well too. Black Duck feels more enterprisey and I'm worried it might be overkill.
Has anyone run all three on a similar stack? I'm particularly curious about:
1. Accuracy of the vulnerability data for npm packages (less false positives).
2. How they handle license scanning for transitive dependencies.
3. The developer experience – are the results easy to act on, or just overwhelming?
Any concrete gotchas or config tips would be super helpful. My team is leaning towards FOSSA because of the licensing focus, but I want to make sure we're not missing something on the security side.