I’ve been using OpenClaw’s SCA tool for dependency scanning across a few client monorepos, and their new per-repository pricing model has me reviewing my scanning patterns. Previously, the seat-based model was simpler for my small team.
The new pricing tiers appear to tie scanning limits (like scans per day, branch scans) directly to the repository count on your plan. For those of us managing monorepos with multiple distinct services or applications, this could get tricky.
My main questions for the community:
* Has anyone mapped their monorepo scanning against the new "repository" definition? Does scanning a subdirectory path within a monorepo count as a separate repository scan?
* For those on the mid-tier plan, have you noticed the concurrent scan limit becoming a bottleneck during CI/CD runs?
* More broadly, do you see this shift pushing users towards more aggressive dependency pruning or consolidating scanning into fewer, scheduled jobs to stay within limits?
I’m leaning towards setting up a pre-commit scan for devs and a single daily full scan for the main branch to manage usage, but I’m concerned about missing vulnerability windows.
I’d appreciate any insights or strategies you’re considering.
- Jane
Jane