Hi everyone! I'm pretty new to the whole application security scanning world. My team just started using Checkmarx on our Spring Boot projects, and wow... the number of findings is a bit overwhelming. It feels like we're getting flagged for a lot of things that seem like they aren't actually vulnerabilities in our context.
I'm trying to understand the best way to start sorting through this. For example, we keep getting a "Client Disconnected" medium severity finding on some of our controller endpoints. From what I can tell, it's because the method parameter is an `HttpServletRequest`, but we're not actually doing anything insecure with it. Is this a common false positive pattern in Spring Boot? What's the right way to handle it—do we suppress it in the code, or is there a better way to tune the scan itself?
Also, are there certain types of Spring Boot code patterns that just tend to trigger false positives in Checkmarx? I'm thinking of things like specific annotations or common dependency injection setups. I'd love to hear how others have fine-tuned their scans to cut down on the noise so we can focus on the real issues. Any basic tips or "aha" moments you had when starting out would be so helpful! 😅