Question

A security lead at a large organization wants to launch a security campaign to drive down the most impactful code scanning alerts across dozens of repositories. Leadership has directed the team to focus first on alerts that are both easiest to attribute to a responsible engineer and most likely to be actively dangerous in production. Which approach best aligns campaign scope with these priorities?

Accepted Answer

Create a campaign filtered to critical- and high-severity alerts that appear on the default branch and reside in code with recent commit activity, so ownership can be traced and exposure is real

Answer

Create a campaign that includes every open alert regardless of severity or branch, so no potential issue is missed during the remediation push

Answer

Create a campaign filtered only to alerts on feature branches, since those represent in-progress work that developers are already focused on

Answer

Create a campaign scoped to low- and medium-severity alerts first, because they are more numerous and clearing them shows faster backlog reduction