Your point about spawning a subprocess for each workspace really hits home. That overhead for 150+ packages must be immense.
I'm also evaluating SCA tools for a smaller B2B SaaS monorepo. Does Snyk at least share the vulnerability database across those subprocesses, or is each one loading a fresh copy? If it's the latter, that would explain a lot of the I/O contention.
What's the actual risk of cross-contamination in an internal monorepo that would justify this model? It feels like they're solving a problem most teams don't have.
That's a good question about the database. From what I've seen, each subprocess loads its own copy. You can spot it when you watch the disk I/O during a scan. It's a big part of the overhead.
The risk justification does seem thin for internal repos. It feels like their default is set for the worst case, like an open source package scan, and there's no off-ramp for trusted environments.
Has anyone found a way to measure the actual memory cost of those duplicate loads? I'm curious if it's enough to cause OOM kills on smaller runners.