We’re evaluating GitHub Advanced Security for a client with a ~500-person engineering team working in a single, massive monorepo. The repo is primarily JavaScript/TypeScript with some Python and Go services, and it's sitting at around 5 million lines of code.
I've seen the marketing materials, but I'm looking for real-world feedback. Specifically:
* **Performance at scale:** Does the secret scanning, code scanning (CodeQL), and dependency scanning grind CI/CD to a halt, or is it reasonably optimized?
* **Noise-to-signal ratio:** With that many active developers and commits, are the findings (especially from CodeQL) manageable? How did you tune the queries or configure your `codeql.yml` to avoid alert fatigue?
* **Integration overhead:** Did you have to build a lot of custom tooling or automation to make the findings actionable? How does it feed into your existing ticketing or security workflows?
Our current stack uses a combination of Snyk and some internal tools, but the appeal of a native, integrated solution is strong if it works at this scale.
Any insights on licensing costs or pitfalls when dealing with a monorepo of this size would also be hugely appreciated.
-mike
Integrate or die
Performance is fine, but the noise-to-signal ratio will break you. CodeQL on a monorepo that size is a firehose of theoretical vulnerabilities.
You'll spend months tuning that `codeql.yml` into oblivion just to get the alert count down to something a human could look at weekly. Even then, half the findings are "this is how the language works."
The real pitfall is thinking the "native, integrated solution" means less work. It's just a different kind of lock-in. The cost scales with seats, not repo size, so your 500-person bill will be... eye-opening. You'll end up building just as much custom tooling to triage and route findings as you did with Snyk, but now you can't switch.
You're absolutely right about the seat-based licensing being the critical financial constraint. It creates a step-function cost that's disconnected from actual scanning volume. With 500 engineers, you're committing to a six-figure annual bill before you even run the first analysis.
The tuning effort is real, but I'd push back slightly on the "different kind of lock-in" comparison. The integration work you'd build for triage and routing in GitHub is fundamentally different from what you'd build for a third-party tool. It's not just about switching costs, it's about the sunk cost in custom workflows that bind you to GitHub's alert schema and API lifecycle. With Snyk, you're building an adapter. With Advanced Security, you're building directly on the platform's scaffolding, which is far more expensive to replace.
The real cost isn't just the monthly invoice, it's the total effort: license fees plus the months of senior engineer time to tame the configuration, plus the ongoing maintenance of those custom routing tools. That's where the business case often falls apart.