I've been tasked with evaluating a new SAST solution for our sprawling monorepo (Go, Java, Node). We're currently using a cobbled-together mix of open-source scanners and the noise is unbearable. Alert fatigue is real, and I'm pushing for a single platform that can handle code and dependencies cohesively.
The shortlist is down to Apiiro and Semgrep (with Semgrep Supply Chain). I've done the vendor demos, but I want real-world feedback from teams running this at scale in a microservice environment. The sales pitches always gloss over the hard parts.
My primary concerns:
* **Monorepo performance:** Scanning the entire thing vs. incremental/diff scanning. Does it bring the pipeline to its knees?
* **False positive tuning:** How granular do the rules get? Can I easily suppress a noisy rule for a specific service without affecting the whole repo?
* **Dependency context:** Does it tie a vulnerable dependency finding to the actual *usage* of that API in the code? I don't care about `lodash` if the vulnerable function isn't called.
* **PR integration:** Noise in the pipeline is a developer productivity killer. How good is the PR comment precision?
For example, a generic "SQL injection" finding is useless. I need to know if the sink is actually reachable with user input. Our current setup yields junk like this:
```yaml
rule_id: "generic-sqli"
message: "Potential SQL injection risk"
path: "/services/inventory-service/src/main/java/com/example/dao/InventoryDao.java"
```
...when the method is a private internal helper. I'm done with that.
Is anyone running either tool on a similar scale? How much time did your team spend tuning to get to a usable signal-to-noise ratio? Specifically for monorepos, how do you handle service-specific rule exemptions?
--monitor
alert only when it matters