Hey everyone! With GitHub Advanced Security's SAST being a major player, I'm curious what the landscape looks like for a small, fast-moving team planning for next year. We're a team of five, mostly doing Go and TypeScript, and our current "SAST" is basically `gosec` and `npm audit` in the CI pipeline. It works, but it's getting noisy and we know we're missing context.
For a team our size in 2026, I'm weighing a few paths:
1. **Going all-in on GHAS:** Leveraging the native CodeQL integration. The push-based scanning is attractive.
2. **A dedicated OSS SAST tool:** Something like Semgrep or Trivy, which we'd run in our own runners.
3. **A hybrid approach:** Using GHAS for PRs, but supplementing with a more configurable tool for deeper, scheduled scans.
My main concerns are:
* **Noise-to-signal ratio:** We can't spend hours triaging false positives.
* **Configuration as code:** We want everything in our repo, not in a SaaS dashboard.
* **Cost predictability:** GHAS pricing per committer is clear, but will it feel "worth it" for a tiny team?
Here's a snippet of how we currently run checks, which is probably familiar:
```yaml
# In our GitHub Actions workflow
- name: Run Go Security Check
run: |
go install github.com/securego/gosec/v2/cmd/gosec@latest
gosec ./...
```
Has anyone made a similar decision recently? I'm particularly interested in how CodeQL's learning curve compares to setting up something like Semgrep. Also, how well do these tools play with OpenTelemetry for emitting metrics on findings? I'd love to chart vulnerability trends right in Grafana. 🦉
I'm a staff engineer at a 90-person fintech running 200+ microservices in Go and Node, and we've evaluated most major SAST tools over the past 18 months. In production, we currently use a mix of GitHub Advanced Security and Semgrep, with Trivy for SCA.
* **Noise-to-signal ratio**: GHAS CodeQL with default rules gave us about 40% actionable alerts for Go/TS. Semgrep, after a month of tuning our own rules on top of the standard registry, sits at about 70-75% actionable. The default Semgrep rule packs were nearly as noisy as CodeQL.
* **Configuration as code**: Semgrep wins. Your entire policy is `.semgrep.yml` in the repo. GHAS requires you to configure CodeQL analysis through the GitHub UI or API; your scan configuration isn't fully portable or versioned alongside your code.
* **Cost predictability**: GHAS is ~$49/active committer/month on Enterprise Cloud. For five engineers, that's ~$3k/year. Semgrep's Team tier is ~$4-8/user/month depending on your contract, so roughly $240-$480/year for your team. Trivy is free but requires engineering time to manage.
* **Integration and maintenance burden**: GHAS push-based scanning is zero-config after setup. Running Semgrep or Trivy in your own runners means managing the CI jobs, updating the tool versions, and caching databases. It's maybe half a day per quarter of upkeep.
I'd go with Semgrep on its Team plan. It gives you the configuration-as-code you want and, after initial tuning, a better signal-to-noise ratio for your stack. If your absolute priority is zero maintenance and you're already on GitHub, choose GHAS. To decide cleanly, tell us your annual security tooling budget and whether you have someone who can own the initial rule tuning for a few weeks.
Observability is not monitoring