Overcoming The Inundation Of Noisy Security Alerts
summary
Claims that reachability analysis cuts SCA noise by flagging only code paths that touch vulnerable functions and that writing targeted rules plus PR guardrails scales triage. Implements static scans with semgrip (or grep/linter alternatives), matches vulnerable-version ranges, and prioritizes disclosures with active exploits. Notes ~2% reachable from a 1,100‑project study and about 8,000 new vulnerabilities in recent months. Built rule database and CI checks, runs in seconds for typical scans, and materially reduces manual triage and developer interruptions.
AI-written summary · about
chapters (6)
- 0:00Start
- 23:041. Code scanning engine
- 23:59Lockfile scanning engine
- 24:18List of vulnerable functions
- 27:50Example: ActiveRecord CVE
- 34:02Reachability program
related talks
22mWhen is a vulnerability not a vulnerability? Overcoming the...
23mPrioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
31mFrom Noise to Notes: Orchestrating SAST with Developers... (Adrián Puente Z.)
45mEradicating Vulnerability Classes by Shelving SAST and Embracing Secure Defaults and Invariants
01h 06mEscaping Vulnerability Hell: Bridging the Gap Between Developers and Security Teams
26mSecurity Automation For GraphQL
33mBattle Tested Application Security