Loading…
26
Switched our SAST scan from nightly to on every pull request and the noise problem mostly went away
Our team was drowning in a 900 finding backlog from a nightly SAST scan that nobody read. Last month I moved the scanner to run on every pull request instead, only gating on new issues in the diff, and in three weeks we cleared about 200 old findings because people finally trusted the results. The big difference was volume per run: one or two real issues tied to code someone just wrote beats a wall of old stuff every morning. We used Semgrep with a custom ruleset for our stack, and the PR comment showing the exact line made triage way faster than the old HTML report. Curious if anyone else gates on diff only or if you still run a full sweep on a schedule somewhere.
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.