Loading…
9
Wasted $2,100 on a commercial SAST tool our team stopped opening after 3 weeks
Two years back I pushed hard to get a static analysis tool into our pipeline. The sales guys ran a demo with a fake repo and it lit up like a Christmas tree, so I got sign off on a $2,100 annual license for a 12 person team. The catch was nobody told me the scan took 40 minutes on our main service. Devs would push code, wait, then get 600 findings, most of them style nits in test files. Within 3 weeks people were clicking "ignore all" just to get the build green. I tried to tune the rules but it was a config nightmare and the docs read like they were written by a lawyer. We ended up ripping it out and going back to a free linter plus a short checklist in the PR template. If you are shopping for one of these, run it on your actual repo first and count how many findings a dev would have to read to find one real bug.
1 comments
Log in to join the discussion
Log In1 Comment
derek992d ago
Isn't $2,100 kinda cheap for a 12 person team?
10