Your recommended stack

2 areas to cover, based on what you told us

“Security and compliance are asking questions”

1. Application Security Testing

Because you said: “Security and compliance are asking questions”

SnykBest fitfrom $25Free tier

Developer-first security across dependencies, code, containers and infrastructure.

Why this fits you

Reachability analysis dramatically cuts the noise from transitive dependency alerts.
Automated fix pull requests make remediation a merge rather than a project.

Main limitation

OWASP ZAPOpen source

The free, open-source DAST scanner that attacks your running application.

Why this fits you

Free, with no licence limits on scanning or users.
The baseline scan runs in CI in a couple of minutes and catches real misconfiguration.

Main limitation

Higher false-positive rate than commercial DAST tools.
Scanning authenticated, JavaScript-heavy applications requires meaningful configuration effort.

Burp Suitefrom $475Paid

The professional web security tester's tool of choice, plus an enterprise scanner.

Why this fits you

Main limitation

Because you said: “Security and compliance are asking questions”

SonarQubeBest fitfrom €32Free tier

The static-analysis standard: 30+ languages, quality gates, clean-as-you-code.

Why this fits you

Clean-as-you-code is the only quality-gate model that reliably works on legacy codebases.
Very broad language coverage from one tool and one gate.

Main limitation

Branch and pull-request analysis — the feature most teams actually need — is paid only.
Default rule sets are noisy until tuned to the team.

ESLintOpen source

The JavaScript and TypeScript linter every project ends up using.

Why this fits you

Main limitation

Configuration is a real project of its own, and the flat-config migration caused significant churn.
Slow on large codebases without caching.