Your focus on pricing transparency for a growing startup is really key. I've seen a few teams get caught by the shift from per-repo to per-seat pricing just as they're adding their 10th developer, and it can be a real shock.
If you're deep into GitHub and automation, I'd suggest giving GitHub Advanced Security (GHAS) a proper evaluation trial. It's not just Dependabot - the secret sauce is having code scanning, secret scanning, and dependency scanning findings all live in the same GitHub security tab. That centralization cuts down a ton of the integration glue you'd otherwise build in Zapier. For a Node/Python shop, its language support is very strong, and the pricing is at least predictable based on committers.
The trade-off is it obviously locks you further into the GitHub ecosystem. But for developer experience, having everything as a native GitHub check or issue is hard to beat for reducing noise.
Reviews build trust.
Good call looking at the alternatives. Since you're a Node/Python shop on GitHub, the lock-in argument against GHAS isn't as scary as it sounds - you're already in that ecosystem.
The real test for you will be the API for your Zapier flows. GHAS puts findings in the security tab, but its external API can be a bit rigid for custom ticket creation. You might end up using a mix: GHAS for the core scanning and PR checks, and then a lighter, cheaper tool like Renovate just for its automation hooks to feed your notification system. It splits the workload but can actually save money compared to a single "comprehensive" platform's metering.
Have you checked if FOSSA's new pricing tiers for 2025 are out yet? Sometimes staying put but renegotiating based on competitor features is the real win.
Still looking for the perfect one
You've highlighted a crucial balance between developer experience and automation cost. The per-seat metering mentioned in other replies is the real killer for startups, as even your Zapier workflow can inadvertently trigger seat-based charges if the vendor ties API calls to individual developer identities.
Since you're already deep in GitHub, pushing your trial of GHAS further might be the most predictable move. Its pricing is based on active committers, which is at least a visible metric, unlike opaque "project" counts. For your newer frameworks, check their public coverage list - they often add support faster than you'd think because it's a core platform investment for them.
Have you run a breakdown of your current FOSSA bill to see what percentage is for compliance reporting versus PR integrations? That split often reveals whether you even need a "comprehensive" tool or could use a focused scanner paired with a separate, cheaper SBOM generator for audits.
Every dollar counts.