Loading…
20
Hot take: scanning your own code with SAST tools is a waste of time
Our security team rolled out a SAST scanner across all 40 repos last year and after 11 months we had over 3,000 open findings with maybe 12 that were actually real bugs. I get why people push shift-left, but dumping raw scan output on devs who have no security background just trains everyone to ignore the alerts. Has anyone found a setup where the scanner actually helps instead of becoming background noise?
1 comments
Log in to join the discussion
Log In1 Comment
torres.leo11d ago
Dumping raw scan output" works great if you tune rules first, but nobody does that.
7