Most security teams have lived through this. A scanner is added to the pipeline with every rule set to block. On day one it fails every build in the organisation, because the codebase already has hundreds of findings. By the end of the week there is an urgent request to make the step non-blocking "just for now". A month later nobody looks at its output.

Prefer to watch? A short Q&A on the same topic:

A CI/CD security gate is only useful if it stays switched on. This post covers how to design one that does.

What a security gate is for

A gate is a pipeline step that can stop a change from merging or deploying when it introduces a security problem.…