- Role
- Came up with the idea; co-built it with teammates
- Context
- Application security programme for a cloud-hosted product
- Stack
- CI/CD pipelines, static application security testing, a central findings dashboard
The problem
Every static scan costs money. Scanning on every push adds up quickly and buries engineers in repeat results, but skipping scans leaves code unchecked. The team needed regular coverage without paying for redundant runs.
What I built
A scanning step wired into the CI/CD pipeline, so developers don't need to remember to run anything. Its rules are short:
- A push to a configured branch triggers the check.
- If a scan has already run in the past 90 days, the pipeline skips it.
- If not, the pipeline runs the scan.
- A manual run always scans and skips the 90-day check.
- Results and findings are published to a central dashboard.
Why it works
The 90-day rule keeps the cost of each scan in check while still guaranteeing that every configured repository is scanned regularly. The manual override means anyone can get a fresh result on demand, for example before a release or after a fix. Putting findings on one dashboard gives engineering a single list to work through and gives security a view across repositories.