Loading…
0
Spent $85 on a 'one click' cloud security scanner and it flagged our own health check page as a critical threat
About two months ago I got talked into a free trial of one of those point and click security scanners for our CI pipeline. The sales guy promised it would plug into GitHub Actions in under ten minutes and catch everything our SAST tool missed. I paid $85 for the first month and spent a full day wiring up the API keys and config files. First scan came back with 47 critical findings. I got a pit in my stomach and started messaging my manager. Turns out 44 of them were our own internal health check endpoints and three were false positives on a static HTML page. The one real issue was a hardcoded test key in a sandbox repo nobody deploys. I turned the whole thing off that Friday and told my manager it was a bust. We now just use the free tier of Semgrep and a simple secrets check in pre commit. Has anyone found a scanner that does not drown you in noise, or is that just how these tools work?
1 comments
Log in to join the discussion
Log In1 Comment
fiona3306d ago
Been there with a tool that cried wolf on every single scan, total waste of money and time.
4