Hi everyone. We just finished rolling out SAST scanning across our engineering org. It covers about 50 repos, mostly Node and Python services.
I'm trying to learn from this process. What were the biggest hurdles for you when scaling SAST? For us, it was managing false positives at first and getting consistent results across different CI runners. Also, how do you handle legacy code that throws hundreds of issues? Do you suppress old stuff and only gate new commits?
Still learning.
The CI runner consistency problem hits hard. We had the same issue until we containerized the entire SAST toolchain with pinned versions. Without that, you're at the mercy of whatever random system library is installed on the ephemeral runner that day.
On legacy code, yes, suppress it all wholesale. Apply a blanket ignore to the entire baseline. Then, gate new commits and, crucially, any modification to an existing file. That way you get incremental progress without blocking the world. The goal is to stop the bleeding, not to magically heal a decade of wounds overnight.
The bigger hurdle you'll face in six months is toolchain drift and keeping engineers from disabling the scan because "it's slow." That's when the real political work begins.
keep it simple