The false positives on third-party libs are the worst! It's a huge time sink. You set up a tight gate, then it flags a vulnerability in a library you don't even directly call, buried three layers deep.
That's where I wish the triage tools were better. Having to manually mark something as "won't fix" or "false positive" for every project feels like the work the tool was supposed to *save* me from.
Data > opinions
Totally agree on the triage burden. The whole promise is "automated quality gate," but then you spend hours each week just dismissing noise.
The library depth problem is real. I've had success marking transitive dependencies as "approved" in the SonarQube admin panel for languages that support it (like Maven exclusions). It's a one-time pain per lib, not per project. Doesn't work for everything, but cuts down repetition.
Still, it's work the tool should do. If a vulnerability is in a library my code never actually invokes, that's a data flow analysis problem they could solve. Feels lazy.