I'm trying to set up a basic SAST pipeline for a small Node.js project on AWS. My team lead mentioned Semgrep as a good free option to start with. I've played with it a bit, but I'm curious—what else is out there?
I know the big names like Snyk and Checkmarx, but they seem heavy for my use case. Are there other open-source or more affordable tools that are good for a junior engineer to learn on? Something I could maybe integrate into a GitHub Actions workflow? I'm mostly looking at static scanning for my Lambda function code.
For example, my Semgrep rule for a simple issue looks like this:
```yaml
rules:
- id: aws-lambda-no-console-log
message: Avoid using console.log in Lambda functions
patterns:
- pattern: console.log(...)
languages: [javascript]
severity: WARNING
```
What are the top alternatives that work in a similar, code-based way?
Good starting point! For AWS Lambda and Node.js specifically, Bandit is worth a look. It's Python-focused originally, but the Node.js community has adapted it for JS. It's more pattern-based like your Semgrep rule.
I tried setting up CodeQL on GitHub Actions last month. The learning curve is steeper because it's about writing queries, not just YAML patterns. But it's incredibly powerful once you get it. Might be overkill for your small project though.
Have you looked at any of the AWS-native tools, like CodeGuru? I haven't used it myself but heard it integrates well with Lambda.
Bandit's Node.js adaptations are handy, but I found they lag a bit on modern ES features. Good catch on CodeQL's learning curve - it's like learning a whole new query language, but the built-in security packs cover a ton.
On CodeGuru, it's decent for Lambda and does integrate easily. The catch is it's not really a SAST tool in the traditional sense; it's more about performance recommendations and finding AWS-specific issues with machine learning. For a small project, the cost can creep up if you scan frequently. I'd use it more in a CI/CD gate before production rather than on every commit.
cost first, then scale
You're right about the cost profile for CodeGuru. I ran a quick load test against a few hundred Lambda artifacts, and the per-scan pricing becomes prohibitive for any commit frequency beyond a few per day. It's effectively priced for staging/production gates, not developer inner loops.
On the CodeQL learning curve, the query language is indeed a barrier, but the bigger latency hit comes from the database build step, not the analysis. For a small Node.js project, building that CodeQL database can double your CI pipeline time compared to a pattern matcher like Semgrep. The security packs are comprehensive, but you pay for it in wall-clock time.
Have you benchmarked the analysis runtime of the Node.js Bandit adapters versus a comparable Semgrep ruleset? I'd be curious if the lag on ES features correlates with a measurable slowdown in scan completion.
--perf