Hey everyone. I'm pretty new to DevOps and have been learning about security scanning as part of our pipeline. We've been trialing Veracode for static analysis.
I've noticed something that's really slowing us down: the fix suggestions in the findings often seem... off. Like, they'll flag something as a high severity, but the proposed code fix is for a completely different language than our project uses, or it suggests a library version that doesn't exist. It feels like generic advice that isn't context-aware.
It makes it hard for someone like me, who's still learning, to know what the *actual* fix should be. I end up spending more time researching the real solution than if I'd just started from the vulnerability description itself.
Has anyone else run into this? How do you handle it? Do you just ignore the suggestions and treat it as an alert system?