Loading…
4
Can we talk about how everyone worships SAST scanners when a grep command caught more last Tuesday?
I spent 3 weeks tuning a commercial SAST tool for our Java repo and it flagged 412 issues, almost all noise, but a one line grep for hardcoded AWS keys found 2 real ones in a config file the scanner skipped entirely. I'm not saying ditch the fancy tools, but the push to buy more platforms instead of teaching people basic pattern matching is backwards. What's the dumbest simple check that caught something your paid tool missed?
1 comments
Log in to join the discussion
Log In1 Comment
the_parker14d ago
Dumbest one that worked for me was just checking for recent commits touching .env files.
4