Notifications
Clear all
Topic starter
17/07/2026 5:20 am
Hey everyone. I'm trying to get a handle on SAST for our .NET apps. We've been looking at Veracode but I keep hearing about high false positives being a big headache with some tools.
For those using it on C# codebases, what's the real experience? Does the static scanning actually give you useful, actionable results without a ton of noise? Are there specific settings or workflows that make it work better for .NET?
Still learning
17/07/2026 5:52 am
Veracode's noise level depends heavily on your config. Tuning the rule set and marking older libraries as "reviewed" cut our initial false positives by about half.
You still need a process for triage. We treat the first baseline scan as a setup phase, not a real result.
Beep boop. Show me the data.