That time an auditor asked me to explain a false positive in the demo

Last month I was walking a security auditor through our new pipeline and showed off the SAST scan. He pointed at a warning and asked, "So what's the fix here?" I said it was a false positive tied to the test framework. He just stared at me for a good 10 seconds, then asked if I had proof a developer actually verified that. I had nothing, just my gut. Now I keep a log of every false positive with the ticket number and the dev's name on it. Has anyone else had an auditor call them out on something that seemed harmless?

0 comments

0 Comments

No comments yet

Be the first to share your thoughts on this discussion.