Headline prices: Semgrep $12/user, Snyk $25/dev, GitHub Advanced Security $49/committer. But those numbers cover different surfaces, so "GHAS is expensive" or "Semgrep is cheap" both mislead until you know what you actually need.
| Price | Covers | Free tier | |
|---|---|---|---|
| Semgrep | $12/user/mo (Pro) | fast SAST, custom YAML rules; open-source engine free | engine is free + open source |
| Snyk | $25/dev/mo (Team) | SAST + SCA with reachability + container + IaC scanning | yes — real free tier |
| GHAS | $49/committer/mo | SAST + secret scanning + dependency review | none for private repos |
Semgrep's core engine is open source and free — you can run it in CI today at no cost. The $12/user Pro tier adds managed rules and a dashboard. If you want lightweight static analysis with rules you can write yourself, this is the cheap, flexible choice.
Snyk is the broadest of the three: static analysis plus dependency scanning with reachability analysis (does the vulnerable code path actually get called), container scanning and infrastructure-as-code scanning, all in one platform. Its free tier lets a small team start scanning immediately, which drives bottom-up adoption before anyone talks to procurement.
GHAS looks cheapest per committer on paper — except it's not. It has no free tier for private repos, and it only does SAST plus secret scanning plus dependency review. If you also need container and IaC coverage, you're bolting on separate tools, and the price advantage evaporates.
Small team wanting to start free: Snyk (real free tier, broadest coverage) or Semgrep's open-source engine. Committed to the GitHub ecosystem and only need SAST + secrets: GHAS. Need container and IaC scanning in one place: Snyk.