I’m looking into open-source vulnerability scanners for application code and dependencies, and I’m curious what developers are actually using in production. There are plenty of tools that scan repositories for CVEs, vulnerable dependencies, secrets, and misconfigurations. But I’m interested in the day-to-day experience of using them. A few questions for people who work with these tools: What do you use today? Trivy, Grype, OSV-Scanner, Semgrep, Snyk, Dependabot, something else? What frustrates you the most? False positives, noisy alerts, difficult setup, slow scans, constant triage, or findings that aren’t actionable? Where do existing tools fall short? Are there vulnerabilities or risks they routinely miss? How much work does remediation take? Do you get useful fixes, or does your team still have to investigate every finding manually? What would make you switch? A simpler workflow, better prioritization, more accurate detection, automatic fixes, or something else? I’m particularly interested in what happens after a scanner finds something: how teams decide whether it’s a real risk and what to fix first. I’d appreciate hearing from people who use these tools regularly, especially in smaller engineering teams. What works, and what still feels broken? submitted by /u/Longjumping-Play6541
Originally posted by u/Longjumping-Play6541 on r/ClaudeCode