If you want your SAST tool to be worth a damn you need to write your own rules, at a minimum configure sources and sinks manually especially in an app that has

If you want your SAST tool to be worth a damn you need to write your own rules, at a minimum configure sources and sinks manually especially in an app that has a lot of dependencies. Last time I checked the security scanning tools that GitLab provides don’t really allow you to do that, SAST is expensive and also require manpower to manage well I guess if you only want to tick a box it might be worth it but I wouldn’t call the security features of GitLab worth the money you’re paying for especially with a large number of users.