What SAST tool actually works for a 1-person side project?

The landscape of Static Application Security Testing (SAST) tools is overwhelmingly geared towards enterprise teams with dedicated security engineers and substantial budgets. For a solo developer on a side project, the common offerings are either prohibitively expensive, require significant configuration overhead, or produce output that is more noise than signal, effectively negating any productivity gain.

My core requirements for such a tool are:
* **Zero or minimal ongoing configuration:** I cannot afford to constantly tune rules for my specific, evolving codebase.
* **Low false positive rate:** A 1-person project has zero time for triaging hundreds of irrelevant findings.
* **Fast feedback loop:** It must integrate into a local development workflow, not just CI/CD, and complete in seconds, not minutes.
* **Cost-effective:** Ideally free for public/non-commercial projects, or with a transparent, low-cost tier.

I have evaluated several popular tools against these criteria and found significant gaps.

**Semgrep's Proposition:**
Semgrep appears to position itself as a candidate by emphasizing a simple, pattern-matching syntax and a large, curated set of security rules. The promise of writing custom rules in the language of the code (e.g., Python for Python) is compelling for a solo dev who might need to enforce project-specific patterns beyond security. However, in practice, does this hold up for a small-scale project?

**Key Questions for Discussion:**
1. For a solo developer, is the primary value in the curated rule sets (like `p/security-audit`), or is the true power in the ability to easily create custom rules for code quality? Does the latter become a time sink?
2. How does Semgrep's performance and accuracy compare, in real-world use, to other tools that might be simpler but more limited (e.g., `bandit` for Python, `gosec` for Go) when used in isolation?
3. What is the actual experience of integrating Semgrep into a local pre-commit hook or a lightweight CI like GitHub Actions for a monorepo with 2-3 languages? Is the `semgrep ci` setup straightforward, or does it introduce complexity?

A concrete example of my concern: A default scan of a small Flask app with `semgrep scan --config=p/security-audit` yielded several findings related to SQL injection. While correct in theory, they flagged parameterized queries using SQLAlchemy's text() function, which *can* be safe if parameters are passed correctly. This required manual inspection, defeating the "low noise" goal.

```python
# Example of a flagged pattern (simplified)
from sqlalchemy import text

query = text("SELECT * FROM users WHERE id = :user_id")
result = conn.execute(query, user_id=request.args['id']) # Semgrep rule `python.sqlalchemy.security.sqlalchemy-execute-raw-query.sqlalchemy-execute-raw-query` triggered.
```

Is this a matter of needing to disable specific rules, or does it indicate that even the curated security rules require contextual understanding that a generic tool cannot have? I am seeking reviews from other solo developers who have operationalized Semgrep successfully for their projects. What is your workflow, and what subset of functionality actually delivers value proportional to the time invested?