14
Had to choose between a SAST tool with 50 false positives a day or one with 10 but missing a key OWASP rule...
I went with the 10 false positives and patched the missing rule myself last month, and now our pipeline actually lets devs through without screaming at every commit, has anyone else had to roll their own fix for a commercial tool?
1 comments
Log in to join the discussion
Log In1 Comment
max_ramirez481mo ago
Had to choose between a SAST tool" is already a nightmare scenario, but 50 false positives a day? That's insane, I'd lose my mind watching that pile up. Patching the missing rule yourself is the kinda hands-on fix most teams would just complain about instead of doing. Did the vendor even acknowledge the gap when you reported it?
8