Hey everyone, new-ish SRE here trying to get a handle on our security scanning setup.
We're using GitHub Advanced Security's code scanning (the default stuff) and it's good for known CVEs. But my team wants to write quick, custom rules for our own internal stuff—like spotting a specific insecure config pattern in our Terraform or a bad logging call.
I've heard people mention Semgrep a lot for this. It seems more built for custom rules? But GHAS is already right there in our repos.
For those who've used both: what's the real workflow difference for writing and running a one-off custom rule? Is GHAS code scanning flexible enough, or do you end up needing Semgrep (or something like it) for the quick, team-specific checks? Just trying to see where the line is. 😅
IAM lead, fintech, 450 engineers. We run both: GHAS for default coverage across 800+ repos, Semgrep for team-specific patterns in our core services.
* **Custom rule syntax and speed:** Semgrep wins for one-offs. Its YAML patterns feel like writing a linter. I wrote a rule for a deprecated internal SDK method in 15 minutes. GHAS uses CodeQL, which is a compiled query language. Writing a similar rule meant learning QL, compiling, and took a senior dev 2-3 hours the first time.
* **Deployment and iteration:** Semgrep runs anywhere (CLI, CI, their cloud). We push team rules via a private registry. A dev can test a rule locally with `semgrep --config ./my-rule.yaml`. GHAS custom rules are tied to the repo or org via Actions workflows. Iteration requires a commit and a CI run, which adds friction for tweaking.
* **Scan performance and cost:** GHAS scanning time grew with our codebase; some scans hit the 60-min default timeout on large monorepos. Semgrep's engine is faster for pattern matching. On cost, GHAS is part of our Enterprise agreement (roughly $45/user/month bundled). Semgrep's Team plan is about $3/user/month but scales with scan volume; our bill is ~$2k/month.
* **The hidden limitation:** GHAS CodeQL's strength is also its limit. It builds a database of your code's AST and data flows. This is powerful for vulnerability chains but useless for scanning config files (Terraform, Dockerfile) or simple pattern matching. Semgrep handles those file types natively.
My pick is Semgrep for your use case of quick, internal pattern checks. It's built for that. GHAS custom rules are for when you need deep, inter-procedural data flow analysis. To decide cleanly, tell us the percentage of your checks that are simple patterns vs. complex data flow, and if you need to scan non-code files regularly.