Question

A DevOps team runs a static application security testing (SAST) tool as part of their CI/CD pipeline. Currently the tool reports findings but always allows the build to proceed. The security lead proposes configuring the SAST stage to fail the build (block the merge) whenever a HIGH or CRITICAL finding is detected. Which is the MOST likely operational implication the team must plan for before enabling this change?

Accepted Answer

Developer velocity will be disrupted by false positives, so the team needs a tuned baseline and an exception/suppression process before enforcing hard gates

Answer

SAST will no longer be able to scan source code because failing builds prevents the tool from accessing the repository

Answer

The change eliminates the need for any runtime or dynamic testing since all vulnerabilities are now caught at build time

Answer

Blocking builds requires migrating the pipeline to a monolithic architecture to guarantee consistent scan results