I've been tasked with evaluating SAST and SCA tools for our CI pipeline, and I'm down to two primary contenders: Snyk and Checkmarx. We're a mid-sized team running a mix of JavaScript/TypeScript and Python microservices in a monorepo setup. My main goal is to automate security scanning without drowning in false positives or killing our build times.
From a workflow automation perspective, I'm curious about the practical integration experience. Specifically:
* **CI Pipeline Integration:** How smooth is the setup in GitHub Actions? I'm looking for minimal configuration overhead and sensible default rulesets.
* **Monorepo Handling:** Does the tool scan the entire codebase every time, or can it intelligently scope scans based on changed files? Our main pain point is scan duration.
* **False Positive Triage:** What's the process like for suppressing or marking false positives? Is it a one-click action from the PR comment, or does it require a dashboard dive?
* **SAST & SCA Synchronization:** If a vulnerability is found in a dependency (SCA), does the SAST engine also check if the vulnerable function is actually called in our code? I've heard some tools are starting to correlate findings.
I ran a quick benchmark on a sample service and found Snyk's SCA results were faster, but Checkmarx's SAST seemed to dive deeper into custom code paths. I'm leaning towards a single tool for both capabilities to keep the pipeline simple.
Has anyone run both in parallel or switched from one to the other? I'd love to hear about real-world tuning, especially around accuracy versus speed.