Loading…
27
My old team ran SAST scans as a checkbox for 2 years and we missed a basic auth bug the whole time
Back in 2021 we had a scan gate in CI that everyone just clicked past, and it never once caught the missing auth check on our export endpoint. It only got found when a pen tester poked it 6 months later. Anyone else dealt with scans that pass but don't actually catch anything?
1 comments
Log in to join the discussion
Log In1 Comment
henderson.vera18d ago
Watched a buddy go through almost the same thing at his shop. They had a scanner running on every PR but nobody ever looked at the old findings, so the backlog just grew to like 400 open items and everyone treated the whole thing as background noise. The scan was "passing" because someone set it to only fail on high severity, and everything real was sitting in medium. Took a new hire asking why an endpoint had no login check for them to finally notice it. Lesson he took from it was that a gate nobody reads is worse than no gate, cause it makes you feel safe when you're not.
6