Found out our scanner missed 40% of a repo because of one skip rule

I ran our SAST tool against a client's codebase in Austin last Thursday and it came back clean, then a manual review found a hardcoded key in a folder the scanner had quietly skipped. Turns out a stale "exclude test dirs" rule in the config was matching a real production module, and the tool never said a word about it. How do you all keep old skip rules from silently eating your coverage?

0 comments

Log in to join the discussion

Log In

0 Comments

No comments yet

Be the first to share your thoughts on this discussion.