DevSecOps tools comparison: SAST, DAST, SCA and Secrets Scanning

DevSecOps integrates security tools directly into the development process—from the first line of code to production deployment. This article provides a structured overview of the four main categories of DevSecOps tools, explains their respective strengths and limitations, and demonstrates how they are integrated into real-world CI/CD pipelines.

The Four Pillars of DevSecOps Tooling

Tooling Categories and Timing:

  Develop         │  Commit  │  Build   │  Test    │  Deploy
  ─────────────────────────────────────────────────────────
  IDE Plugins     │  Pre-    │          │          │
  (SAST-Lint)     │  Commit  │          │          │
                  │  Hooks   │          │          │
                  │          │  SAST    │          │
                  │          │  SCA     │          │
                  │          │  Secrets │          │
                  │          │          │  DAST    │
                  │          │          │  IAST    │
                  │          │          │          │  Container
                  │          │          │          │  Scanning
                  │          │          │          │  CSPM

Shift-Left Principle:
  → The earlier in the development process they are found → the cheaper they are to fix
  → SAST finds bugs at commit (not after deployment!)
  → Costs: DEV: $1 | CI: $10 | QA: $100 | PROD: $1,000+

SAST - Static Application Security Testing

What SAST can and cannot do:

CAN:
  → Analyze code patterns without execution
  → Detect known vulnerability classes (CWE)
  → Taint analysis: Input → Sink (SQL, HTML, filesystem)
  → Integrates into CI/CD without a running application
  → 100% code coverage (every line is analyzed)

CANNOT:
  → Detect runtime errors (authentication, business logic)
  → False positive rate: 30–60% without tuning!
  → Context-dependent vulnerabilities (API design flaws)

Tool comparison:

Semgrep (OSS + Cloud):
  Strengths:
    → YAML-based rules: easily write your own rules
    → Community ruleset: 1000+ predefined rules
    → Multi-language: Python, Java, JS, Go, Ruby, Rust, C
    → Very fast (no build required)
    → Semgrep OSS: free, CLI integration
    → Semgrep Code (Cloud): taint analysis, dashboard
  Weaknesses:
    → Superficial taint analysis in OSS mode
    → No cross-file analysis in the free tier

  CI/CD (GitHub Actions):
  - uses: returntocorp/semgrep-action@v1
    with:
      config: "p/python p/javascript p/docker"

SonarQube / SonarCloud:
  Strengths:
    → Extensive language support (30+ languages)
    → Quality Gates: PR block if security rating drops
    → Technical debt tracking
    → OWASP Top 10 + CWE coverage reports
    → Good IDE integration (SonarLint)
  Weaknesses:
    → Resource-intensive (self-hosted: 8GB RAM minimum)
    → Licensing: Community Edition free, Enterprise $$$
    → High false-positive rate without tuning

  Recommendation: SonarCloud for smaller teams (free for OSS)

CodeQL (GitHub Advanced Security):
  Strengths:
    → Deep semantic analysis (understands data flow!)
    → Natively integrated by GitHub (GitHub Actions)
    → Good true-positive rate thanks to data flow analysis
    → SARIF output for standardized results
  Weaknesses:
    → Only Java, JS/TS, Python, Go, Ruby, C/C++, C#, Swift
    → Slow (building the CodeQL database takes time)
    → GitHub Advanced Security: requires a paid subscription for private repos

Bandit (Python-specific):
  → OSS, Python only
  → Very fast, low complexity
  → Detects: hardcoded secrets, insecure cryptography, shell injection
  → Ideal as a first SAST layer for Python projects

Gosec (Go-specific):
  → OSS, Go only
  → Detects: SQL injection, path traversal, cryptographic errors in Go

SCA - Software Composition Analysis

What SCA can do:

Goal: Find known CVEs in open-source dependencies

How it works:
  1. Read lock file/manifest: package-lock.json, requirements.txt, go.sum
  2. Build dependency tree (transitive dependencies!)
  3. Compare against CVE database (NVD, OSV, GitHub Advisory DB)
  4. Report: Which packages have known CVEs?

Tool Comparison:

Snyk:
  Strengths:
    → In-depth dependency tree analysis
    → Automatic fix PRs!
    → License scanning (GPL copyleft risks)
    → Container scanning included
    → Good false positive rate
    → Free tier: 200 tests/month
  Weaknesses:
    → Paid for CI/CD integration with many tests
    → Snyk is proprietary (vendor lock-in)

Dependabot (GitHub native):
  Strengths:
    → Automatically integrated into GitHub, free
    → Auto-PRs for security updates
    → Broad ecosystem support
  Weaknesses:
    → No transitive dependency depth for some ecosystems
    → GitHub integration only

OWASP Dependency Check:
  Strengths:
    → OSS, free
    → Many languages/ecosystems
    → Jenkins, Maven, Gradle plugins
  Weaknesses:
    → Higher false positive rate than Snyk
    → Slower database updates

Trivy (OSS from Aqua Security):
  Strengths:
    → Scans container images + file system + Git repos
    → OSS packages + OS packages (apt/rpm) in one tool!
    → Fast, no server required
    → SBOM export (CycloneDX, SPDX)
    → Misconfiguration check: Terraform, Kubernetes, Dockerfile
  Weaknesses:
    → Less GUI than Snyk

  Recommendation: Trivy for container-centric workflows!

  trivy image my-app:latest
  trivy fs ./src/
  trivy repo https://github.com/company/repo

Secrets Scanning

Preventing secret leaks:

Problem: Developers accidentally commit API keys, passwords,
  certificates, and cloud credentials to Git repositories.
  → GitHub already automatically scans for secrets!
  → Nevertheless: manual checks are necessary

Tool Comparison:

Gitleaks:
  Strengths:
    → OSS, very fast (Go-based)
    → Pre-commit hook: Prevents commits containing secrets!
    → Easy CI/CD integration
    → Many predefined regex patterns (AWS, GCP, Stripe, GitHub...)
    → Custom rules possible
  Weaknesses:
    → False positives with test data having similar patterns

  # Pre-commit hook (recommended!):
  gitleaks protect --staged  # Checks staged changes before commit
  gitleaks detect           # Checks entire Git history!

  # Configure in .gitleaks.toml:
  [extend]
  useDefault = true  # Enable all default patterns
  [[rules]]
  id = "custom-internal-key"
  regex = "INTERNAL-KEY-[A-Z0-9]{32}"

TruffleHog:
  Strengths:
    → Also checks metadata, commit messages, branch names
    → Entropy-based detection (high entropy = potential secret)
    → Verifies found secrets against APIs!
  Weaknesses:
    → Slower than Gitleaks for large repos

GitGuardian:
  Strengths:
    → Cloud service, easy GitHub integration
    → Real-time monitoring (immediate alert upon push)
    → Automatic notification to developers
    → Historical analysis of the entire repository
  Weaknesses:
    → Proprietary, paid service for teams

GitHub Secret Scanning:
  → Automatic in public repos (free)
  → GitHub Advanced Security: also private repos
  → Push protection: Block push if secret detected!
  → Direct notification to the developer

Best Practice - Secret Scanning Pipeline:
  Pre-Commit: gitleaks protect --staged  (local, immediate)
  CI:         gitleaks detect --log-opts="HEAD~1..HEAD"  (new commit)
  Nightly:    trufflehog git --since-commit $(git log --format="%H" -1 --skip=30) .

DAST - Dynamic Application Security Testing

What DAST can do:

Goal: Test a running application from the outside (Black Box)

CAN:
  → Authentication bypass, business logic errors
  → Configuration errors (TLS, headers)
  → Runtime vulnerabilities (session management)
  → Injections against the actual application

CANNOT:
  → Code errors with no impact on external behavior
  → All code paths (no 100% coverage)
  → False positive rate tends to be lower than SAST

Tool comparison:

OWASP ZAP (Zed Attack Proxy):
  Strengths:
    → OSS, free, active community
    → Baseline scan can be integrated into CI/CD
    → Active scan for deeper analysis
    → OpenAPI/Swagger import for API testing
    → AJAX spider for SPAs
  Weaknesses:
    → False positive rate during active scan
    → Performance with large applications

  CI/CD (Docker):
  docker run -t owasp/zap2docker-stable zap-baseline.py \
    -t https://staging.example.com \
    -r report.html \
    -z "-config scanner.threadPerHost=2"

Nuclei:
  Strengths:
    → Template-based: 7,000+ community templates
    → Very fast (Go, parallel)
    → Easily write custom templates in YAML
    → CVE-specific templates: test directly against known CVEs
    → APIs, DNS, SSL, HTTP – all in one tool
  Weaknesses:
    → No deep-crawling application analysis (more like targeted scans)

  nuclei -u https://target.com -t nuclei-templates/
  nuclei -u https://target.com -tags cve,misconfig -severity critical,high

Burp Suite Pro (manual + CI):
  Strengths:
    → Most powerful web application testing tool available
    → Burp Suite Enterprise: CI/CD integration
    → Active scanning detects complex vulnerabilities
  Weaknesses:
    → Paid (£449+/year)
    → Enterprise version very expensive
    → Cannot be fully automated (manual expertise required)

CI/CD Integration - Complete Pipeline

GitHub Actions DevSecOps Pipeline (Example):

name: DevSecOps Pipeline
on: [push, pull_request]

jobs:
  sast:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0  # For full history scans

      # Secrets Scanning
      - name: Gitleaks Secret Scan
        uses: gitleaks/gitleaks-action@v2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      # SAST
      - name: Semgrep SAST
        uses: returntocorp/semgrep-action@v1
        with:
          config: "p/python p/javascript p/owasp-top-ten"
          publishToken: ${{ secrets.SEMGREP_APP_TOKEN }}

  sca:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      # SCA + Container Scan
      - name: Trivy SCA Scan
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'fs'
          scan-ref: '.'
          exit-code: '1'  # Build fails on critical CVEs!
          severity: 'CRITICAL,HIGH'
          format: 'sarif'
          output: 'trivy-results.sarif'

      - name: Upload Trivy SARIF
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: 'trivy-results.sarif'

  dast:
    runs-on: ubuntu-latest
    needs: [sast, sca]  # Only if SAST/SCA pass!
    services:
      app:
        image: ${{ env.APP_IMAGE }}
        ports: ['8080:8080']
    steps:
      - name: OWASP ZAP Baseline Scan
        uses: zaproxy/action-baseline@v0.10.0
        with:
          target: 'http://localhost:8080'
          fail_action: warn  # DAST: Warning, not a hard fail

Quality Gates:
  SAST + Secrets → FAIL → No merge!
  SCA CRITICAL → FAIL → No merge!
  SCA HIGH → WARNING → Review required
  DAST → WARNING → Senior review required
  DAST HIGH/CRITICAL → FAIL → No deploy!

GitLab CI configuration:
  stages: [sast, sca, dast, deploy]
  include:
    - template: Security/SAST.gitlab-ci.yml     # Built-in!
    - template: Security/Dependency-Scanning.gitlab-ci.yml
    - template: Security/Secret-Detection.gitlab-ci.yml
    - template: DAST.gitlab-ci.yml
  # GitLab Ultimate: complete security templates included

Tool Selection by Maturity Level

Recommendations by maturity level:

Level 1 - Starting point (cost-effective, immediately implementable):
  Secrets:  Gitleaks (OSS, pre-commit hook)
  SAST:     Semgrep OSS (for primary language)
  SCA:      Dependabot (automatic in GitHub)
  DAST:     OWASP ZAP Baseline (Docker-based)
  → Setup effort: 1–2 days

Level 2 - Advanced:
  Secrets:  GitGuardian or Gitleaks + TruffleHog
  SAST:     SonarCloud + Semgrep (supplementary)
  SCA:      Snyk (Auto-Fix PRs!) + Trivy (Containers)
  DAST:     Nuclei + ZAP Active Scan on staging
  IaC:      Trivy Misconfig + Checkov (Terraform, K8s)
  → Setup time: 1–2 weeks

Level 3 - Enterprise:
  Secrets:  GitGuardian Enterprise + GitHub Advanced Security
  SAST:     CodeQL + SonarQube Enterprise
  SCA:      Snyk Enterprise + SBOM management (DependencyTrack)
  DAST:     Burp Suite Enterprise + HawkScan
  IAST:     Contrast Security or Seeker
  CSPM:     Prisma Cloud or Wiz (Cloud Configuration)
  → Setup time: 1–3 months
  → Annual cost: $50,000–$300,000 (Enterprise)