Hi everyone, and thanks for having such a great community here. I've been learning a ton just reading through the discussions.
I'm currently evaluating SAST/container scanning tools for my team's CI/CD pipeline. We're a Python shop with most of our services containerized. We've been trialing both Veracode and Snyk specifically for their container image scanning capabilities.
From our two-week trial on a set of 15 existing images, I found a curious difference. Snyk's reports were... voluminous, flagging a huge number of vulnerabilities, many in underlying OS packages (like libssl). Veracode's report was noticeably quieter, but the issues it *did* flag seemed more directly relevant to our actual application code and its dependencies (e.g., specific outdated versions of `requests` or `cryptography` in our `requirements.txt`).
It felt like Snyk was casting a wider, more aggressive net, while Veracode was more focused. Has anyone else had this experience? I'm trying to figure out which approach actually leads to fixing more *real* issues that matter in a production container context, rather than just chasing down every possible CVE in base layers we might not fully control.
For those who've used both, which one gave you more actionable, high-priority findings that you actually fixed? Did you feel one had a better signal-to-noise ratio for container workloads specifically?
Any insights would be greatly appreciated!
still learning