Appreciation post: my scanner team kept calling a hardcoded key a 'test value' for like 4 sprints

Diana Lee · 2026-10-22T04:30:03.13795+00:00

We ran a semgrep rule on our main repo last Tuesday and it flagged an API key sitting in a config file that three people had been calling a placeholder for weeks. Turns out it was live and had been pushed to a public branch 6 days earlier, and I only caught it because I actually read the commit diff instead of trusting the ticket saying 'not real'. How do you get a team to stop waving off scanner hits as noise without turning into the compliance person nobody wants to hear from?

SMM Buzz

Loading…

Appreciation post: my scanner team kept calling a hardcoded key a 'test value' for like 4 sprints | Appsec Tools - SMM Buzz