Everyone's pushing GitHub Advanced Security for dependency scanning. The dependency review tool seems to be the main draw. But before I get funneled into another "advanced" pricing tier, I need a reality check.
We're running a dozen FastAPI microservices. Python, a mix of direct and transitive dependencies. The promise is catching vulnerabilities before they hit prod. My questions:
* How does it actually perform against Python dependency trees compared to, say, Snyk or Trivy?
* Is the feedback actionable, or just noise?
* Most importantly, what's the real operational cost beyond the sticker price? I've seen tools that create more work than they save.
Looking for experiences from teams with a similar setup. Did it justify the "advanced" tax?
—EB