Hey everyone! I'm trying to wrap my head around SAST tools for our DevOps pipeline. We're a small shop starting to get more serious about security.
We already use GitLab Ultimate, so GitLab SAST seems like the obvious built-in choice. But I keep hearing about Snyk, especially for its broader vulnerability database and container scanning. Since I'm still learning, could someone break down the real-world feature differences?
I'm curious about things like:
- How accurate/relevant are the findings from each?
- How easy is it to integrate into a CI/CD pipeline (GitLab CI, specifically)?
- What about false positives and tuning options?
- Does Snyk's licensing cost make sense if GitLab SAST is already included?
Any experiences from a DevOps perspective would be super helpful 😅