Hi everyone. Our team is evaluating SAST tools to add to our CI pipeline. We're a Python shop (Django & FastAPI) with a small monorepo containing a couple of services and shared libraries. Our main goal is to catch real, security-critical bugs and high-severity code flaws before they hit main, without drowning in false positives.
I've narrowed it down to Semgrep and CodeQL based on community feedback, but I'm looking for concrete experiences. For a team of our size and stack, which one tends to catch more *real* bugs that you actually stopped and fixed?
Some specific concerns:
* How do they handle Python dependency scanning within the monorepo context?
* What's the false positive rate like for common issues like SQL injection, hardcoded secrets, or unsafe deserialization in Python?
* How much tuning was required to get useful results? For example, with Semgrep, I know you can write custom rules. With CodeQL, you rely more on the built-in queries.
A quick test with Semgrep's default rules gave us a mix of useful findings and some noise on test files. Here's an example of a finding it caught that we considered valid:
```python
# Semgrep flagged this as a potential XSS
from django.shortcuts import render
import html
def unsafe_view(request):
user_input = request.GET.get('comment')
# Rule flagged missing escaping
return render(request, 'template.html', {'comment': user_input})
```
Has anyone run both tools on a similar codebase and compared the output? I'm particularly interested in which tool uncovered subtle, security-relevant bugs that the other missed. Any insights on setup and maintenance overhead for a small team would be great too.