Loading…
9
Pro tip: I ran manual scans on our repos for 3 weeks and finally let a SAST tool in, it found stuff I walked right past
I kept telling my team we didn't need another scanner because I already ran bandit and grep checks across 40 repos each Friday. Then a guy on our platform team set up Semgrep on just the payments service and it flagged a hardcoded API key sitting in a test fixture from 2022. I felt dumb because I had opened that file at least a dozen times and my brain just skipped the string. Two weeks later it caught an SSRF pattern in a helper I wrote myself, and now the scan runs on every PR instead of me playing hero. Anyone else have a tool find something that was hiding in plain sight for years?
0 comments
Log in to join the discussion
Log In0 Comments
No comments yet
Be the first to share your thoughts on this discussion.