audit
2 posts · all writing
The ignore file is where security programs go to die
Every scanner ships a way to make findings disappear. Risk acceptance is fine; losing who accepted it, why, and until when is what kills the program.
Your CI logs are not evidence
A screenshot of a green build will not survive the follow-up: which version, which checks, against what data, and would it answer the same way twice.