Loading…
13
Can we talk about the contractor who said his scan tool 'was basically security'
Was grabbing coffee in Austin last week and overheard a guy on a call saying his team runs a vulnerability scan once a quarter and that counts as their pipeline security. That scan runs after deploy, not before, and nobody on his 14 person team has ever rotated a build secret. The part that stuck with me is how confident he sounded, like the report going green meant the work was done. How are you all getting scan results to actually block a merge without slowing everyone down?
1 comments
Log in to join the discussion
Log In1 Comment
parker_davis4126d ago
Disagree, blocking merges is exactly how you get teams to care.
0