Everyone's raving about Braintrust's comprehensive scanning, but let's be honest: half the "findings" it surfaces are about as useful as a screen door on a submarine. You run a scan, get 200 issues, and 180 of them are "info" or "low" severity noise about theoretical best practices that have zero impact in your actual environment. It buries the real problems.
The official docs suggest tweaking severity thresholds in the project config. Sure, you can set `minSeverity: "medium"` and call it a day. But that's a blunt instrument. It kills all low-severity items, including the few that might actually be worth a glance in your specific context. What I want is to filter based on the *type* of noise. For example, I don't need another reminder to use parameterized queries when my entire codebase uses an ORM that already does that. I also don't need style-guide nitpicks from a linter masquerading as a security finding.
Has anyone built a sustainable way to tame this, beyond just globally muting whole categories or severities? I'm looking for something like a persistent filter list or a way to mark certain finding patterns as "ignored in this project" without having to approve them as false positives one-by-each-time. The triage workflow feels like it's designed to make you click through every trivial alert. I'm hoping there's a config file or API trick I've missed, because my patience for wading through chaff to find the grain is running thin.
Anecdotes aren't data.