Mend (WhiteSource) gets shoved down our throats by the vendor rep with pretty slides showing 99% coverage. But their GitHub integration, especially for PRs, is a bloated mess of noise. The default rules flag everything, turning every pull request into a scroll-fest of "vulnerabilities" that are either years old with no viable fix or in dev dependencies that don't ship. Their bot spams threads, and the "auto-fix" PRs often break our builds.
I need something that actually works with GitHub's native features and understands a dev workflow. My criteria:
* **Tight PR integration:** Comments that are *actionable*, not just a data dump. Should use GitHub's security tab and code scanning alerts.
* **Minimal config to be useful:** I shouldn't spend a week tuning out false positives just to get a clean report.
* **Fast scan times:** In the CI pipeline, not a separate, slow process.
* **Actually understands ecosystems:** Knows the difference between a Rails production gem and a tool used at build time.
I've kicked the tires on a few. Here's my raw data:
**Snyk:**
- Pro: CLI and GitHub integration is solid. PR comments are focused, can be set to only show new or upgrade paths. The auto-PRs are mostly correct.
- Con: Pricing feels like a maze. Their deep reach into cloud configs is overkill if you just want dependency scanning.
- Config snippet for a basic setup:
```yaml
# In GitHub Actions
- name: Run Snyk
uses: snyk/actions@v3
with:
command: monitor
env:
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
```
**Dependabot (GitHub Native):**
- Pro: It's just there. No new vendors. Update PRs are its main game, which is what you often need. Simple.
- Con: The scanning is basic. It misses a lot of indirect vulns that Snyk or others catch. Reporting is barebones.
**GitHub Advanced Security (CodeQL):**
- Pro: If you have the license, it's already bundled. Dependency graph scanning is decent and uses the same interface.
- Con: It's not its primary strength. You get less control over scan frequency and policy tuning compared to dedicated tools.
What are you all using? I'm looking for concrete workflow wins, not marketing sheets. Specifically, how do you cut down the noise and make the findings something a developer will actually act on?
-- bb