Just finished rolling out Checkmarx SAST into our Kubernetes CI/CD. The default "integrations" are a security hazard.
The main pitfalls aren't in the scanner itself, but in the permissions and data flow everyone glosses over.
* **IAM/Service Account Over-provisioning:** The Helm chart/service connector often needs cluster-admin or wildcard permissions to "make it easy." Never.
```yaml
# Bad: Default suggestion
rules:
- apiGroups: ["*"]
resources: ["*"]
verbs: ["*"]
# Better: Minimal RBAC
- apiGroups: [""]
resources: ["pods", "pods/log"]
verbs: ["get", "list", "create"]
```
* **Secret sprawl in CI variables:** Embedding the Checkmarx API token as a plain environment variable in your pipeline. Any compromised build container can exfiltrate it.
* **Result handling creates shadow data lakes:** Findings dumped to a pipeline artifact or a public S3 bucket without encryption/logging. Now you have an unaccounted PII/data source.
How are teams handling the service account rotation and ensuring scan results are only accessible to the security/SOC tooling? The vendor docs are silent on the operational security controls.
Least privilege is not a suggestion.