Loading…
12
DAE remember scanning jars by hand? Took me 3 hours on a Tuesday build last month
Five years back I ran a dependency check on a weekend release and spent about three hours copying versions from a spreadsheet into a ticket, because our scanner wasn't wired to the build. Now the pipeline runs the same check on every pull request and posts a comment with the findings in under two minutes. Last month it caught a bad transitive library on a Tuesday build before anything reached staging, which saved me a whole evening of digging. I still read each finding myself though, since the tool flags plenty of low risk stuff. What does your team do with the low severity hits, fix them right away or let them pile up?
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.