Loading…
25
I added 6 hours of secret SAST scanning per week and our release speed went up, not down
We had a bad week back in March where a hardcoded API key almost shipped to prod, so I pushed for blocking scans on every PR. Everyone said it would kill our velocity. For the first two weeks it did, we had 40 false positives and devs were furious at me. But then we spent a Friday tuning the rules and adding inline suppressions, and by April our mean time to merge dropped from 2.5 days to about 9 hours. Turns out catching issues before review beats arguing about them in the PR comments. Curious if anyone else has seen scan time actually speed up their pipeline instead of slowing it.
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.