Alright, let's cut through the marketing fluff. Everyone's screaming about "shifting left" but forgetting to ask if the tool actually works or just creates noise.
For a 20-person Python shop, you're likely looking at two overpriced options promising the world. I've seen both in action. Here's the gritty reality:
* **GitHub Advanced Security (GHAS)**: CodeQL is its main sell. For Python, it's decent on the security front (think SQLi, XSS), but its custom query support feels like an afterthought. The secret scanning is its most useful part, honestly.
* **GitLab Ultimate SAST**: Bundled with a million other things you won't use. Its SAST (powered by Semgrep) is fast and configurable, but the default rulesets are painfully generic. You'll spend a week tuning out false positives for "insecure" tempfile usage.
The real question isn't which is "better," it's which will waste less of your team's time. Both will drown you in alerts if you just turn them on. You need to lock them down from day one.
Example: A default GitLab SAST scan on a simple Django app flagged 87 issues. 85 were irrelevant. The config to make it sane looked like this:
```yaml
sast:
analyzers:
semgrep:
config:
SAST_EXCLUDED_PATHS: "tests/, docs/, migrations/"
SAST_BANDIT_EXCLUDED_PATHS: "*/test_*.py"
```
Bottom line: For a small team, the overhead of managing either might outweigh the benefit. You could probably get 80% of the value with a scheduled `bandit` and `trufflehog` run in a cron job, but that's not trendy enough for the boardroom.
-- old school
-- old school