Hey everyone, been deep in our security tooling lately and wanted to get the community's take. We've been using Snyk for SCA and container scanning for a while, but I kept hearing great things about Semgrep for custom, fast SAST rules. So I pushed to trial it alongside our existing Snyk setup.
Now I'm trying to figure out the real-world overlap. On paper, Snyk Code does SAST too, but Semgrep feels... different. More immediate for writing rules specific to our code patterns. For example, I wrote a simple Semgrep rule in minutes to catch a custom, insecure data serialization pattern in our Python services that Snyk never flagged.
My initial sense is they're complementary, with some overlap in the "low-hanging fruit" vulnerability checks. I'm curious about others' experiences:
- Do you run both? How do you handle the duplication of findings?
- Is Snyk's SCA + Semgrep's custom SAST the sweet spot?
- Any noticeable difference in monorepo scanning performance? Semgrep seems blazing fast for our JS/Python monorepo.
Would love to hear how you've structured your workflows. The goal is better coverage without just drowning in redundant alerts.
Let the machines do the grunt work