Context Matters: Qualitative Insights into Developers' Approaches and...
summary
Study interviews 20 engineers and reports 20 interviews that reveal SCA tools are usually wired into CI/CD but produce floods of generic alerts that lack concrete impact data, forcing triage and manual work. Findings show ecosystem gaps, teams running multiple SCAs or building custom aggregators, one group even forked the library to remove vulnerable code, and recommend adding reachability context plus infrastructure and network info so SCA stops CI gates causing halts and reduces false positives.
AI-written summary · about
chapters (8)
- 0:00SCA challenges introduction
- 1:59User study on SCA tools
- 3:03Context in vulnerability alerts
- 4:51SCA in development pipelines
- 8:04Fixing vulnerabilities overhead
- 12:42Improving SCA tools
- 13:47Key takeaways for SCA
- 15:09Conclusion
related talks
38mContext Matters: Qualitative Insights into Developers’ Approaches and Challenges with Software...
56mTune your Toolbox for Velocity and Value
23mPrioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
54mOvercoming The Inundation Of Noisy Security Alerts
27mDevelopers Struggle with Application Security (and How to Make ...)
28mWhy Developers Struggle with AppSec
24mObjects In The Rear View Mirror Are Closer Than They Appear
40mDevSecOps Guide to Bulletproof Your Development Workflow