So I finally made the jump from SonarQube to Semgrep about six months ago. I was getting buried in noise from our old setup, especially around dependency findings in our monorepo.
After half a year, the difference in false positives is pretty wild. For example, SonarQube flagged *so* many "vulnerable" library versions that were either false or patched in a later minor version. Semgrep's dependency scanning seems to understand our lockfiles better? The SCA alerts feel more actionable.
On the SAST side, Semgrep's rules felt simpler at first, almost too basic. But I'm finding the precision is way higher for the classic stuff like SQL injection or hardcoded secrets. I still get some weird ones on custom frameworks, but not the avalanche I used to.
Anyone else made a similar switch? How did your false positive rates compare, especially for monorepos? I'm still learning all the terminology 😅