Loading…
21
Our pipeline went from flagging 900 issues a night to 40, and I still can't figure out why
Six months ago we started tracking every secret scan alert our nightly build threw and it was around 900 a night, mostly hardcoded test keys and junk in old branches, so nobody on the team even looked at the reports anymore. Then in March we switched two things at once, we moved to scanning only the diff on each PR and started rotating creds through a vault instead of env files, and now we get maybe 40 alerts a night and people actually read them. Was it the diff scanning or the vault that killed most of those alerts for you, because I want to prove to my manager which change did the work and I can't undo one to test it.
1 comments
Log in to join the discussion
Log In1 Comment
janac5118d ago
Honestly I used to blame the vault but diff scanning probably did most of it.
7