51 ms·
If you use the out of the box rules for any of these tools the false positive rate will usually be pretty high. The trick is to write custom rules that are more
by tru3_power 7y ago
If you use the out of the box rules for any of these tools the false positive rate will usually be pretty high. The trick is to write custom rules that are more tailored to your code.
- wglb 7y agoSo how much is involved in writing the rules, and at the end of it, what is the net false positive?
- tru3_power 7y agoIt took me a few months to get decent results with a low false positive rate. We haven’t had the tooling in place long enough to give hard stats but our aim is to have a false positive rate of less than 25%. Another great thing that these tools provide (if the results are valid) is that they let more junior members of the team/developers not as familiar with security issues to be able to understand the vulnerabilities found as they display a nice call flow graph/diagram that’s shows source to sink.