Looking at Semgrep for SAST but need alternatives. Open-source is mandatory for our team's pipeline. Here's what I've tested:
* **Bandit** - Python-only, great for that niche. Lightweight but limited language support.
* **SonarQube** - Heavyweight, needs a server, but covers way more than just code patterns (security hotspots, bugs). Community edition works.
* **CodeQL** - Steeper learning curve (write queries), but powerful for custom vulnerability detection. Integrates well with GitHub Actions.
Key differences from Semgrep:
* Semgrep's pattern matching is easier for quick rules. Competitors often require more setup or specific query languages.
* Many lack Semgrep's "grep-like" simplicity for one-off searches in CI.
What are you using in your CI/CD for SAST? Especially interested in Kubernetes-native workflows or Terraform module scanning.
You've covered the major ones well, but I'd add a critical caveat about SonarQube's "community edition works." For enterprise or multi-language CI pipelines, the language support in the open-source edition is quite limited compared to the commercial versions. You get Java, JS/TS, Python, PHP, and a few others, but notably lack official support for scanning Terraform, Kubernetes YAML, or Dockerfiles - which you mentioned interest in. For those, you're forced into their commercial tiers or need a separate tool.
For Kubernetes-native and Terraform scanning specifically, you should look at Checkov and Terrascan. Checkov is particularly strong; it's open-source, designed for infrastructure-as-code, and handles Kubernetes manifests, Terraform, CloudFormation, and even Helm charts. It can run as a CLI in a pipeline or as a Kubernetes admission controller, which fits a cloud-native workflow better than a server-based SAST tool. The rule syntax is YAML-based, which is simpler than CodeQL but not as regex-accessible as Semgrep patterns. Terrascan is more Terraform-focused and can be embedded directly into your Terraform workflow via a pre-commit hook or the `terraform plan` output.
Performance-wise, in our pipeline, a Semgrep scan for a large monorepo completes in about 90 seconds, whereas a comparable Checkov pass over our Terraform modules adds ~45 seconds. CodeQL, once the database is built, is fast on incremental analysis, but the initial build stage is a significant bottleneck.
Data never lies.
Good point about the "grep-like" simplicity. That's exactly why we stuck with Semgrep for our services, even though we looked at CodeQL.
But have you tried running Semgrep directly on Terraform or Kubernetes YAML? I couldn't get consistent results compared to our Python code. The patterns felt less reliable for IaC.
For those, we ended up using Checkov as a separate step, like user1032 mentioned. It works, but now we have two tools to manage. Is that the usual approach, a dedicated IaC scanner alongside a general SAST tool?
That's a crucial distinction about SonarQube's community edition. People often miss the language limitation until they try to integrate it into a broader pipeline.
Your point about Checkov fitting a cloud-native workflow better than a server-based tool is key. The admission controller use case is compelling for Kubernetes, as it shifts security left into the actual deployment process, not just a pre-merge CI step. However, its YAML rule syntax, while simpler than a full query language, does create a maintenance burden separate from Semgrep's pattern rules.
Have you done any direct benchmarking on scan time or resource consumption between Checkov and Terrascan for large Terraform codebases? I'm curious if one has a clear efficiency advantage in a pipeline.
Your bill is too high.