Hi everyone. I'm new to this whole "shift left" security thing and trying to choose a SAST tool for our AWS setup. We have a few Java microservices running in ECS, all defined with Terraform.
I've narrowed it down to Semgrep and Contrast Security (the SAST part). Most comparisons are very high-level. Could someone show me a concrete example for a common Java vulnerability?
For example, how would a rule for finding a hardcoded AWS secret look in each tool? A short code snippet for each would be incredibly helpful 😅
I'm especially worried about:
* Ease of adding custom rules (our security team has a few specific patterns).
* How well it integrates into a CI/CD pipeline (we use GitHub Actions).
* Cost implications for a small team.
Any real-world experience between these two for a cloud-focused team would be a lifesaver.