Question

A developer at a fintech company is working through a backlog of code scanning alerts before a release deadline. One alert flags a potential SQL injection in a data-access module. The developer is confident the input is already sanitized upstream and wants to remove the alert from the active list without altering the code. They ask the security team what the correct action is and what the downstream implications will be. What should the security team advise?

Accepted Answer

Dismiss the alert with an accurate reason such as 'False positive' (used when analysis shows the flagged path is not actually exploitable), which records a documented, auditable rationale and prevents the same alert from resurfacing on identical code, while keeping it retrievable for review.

Answer

Delete the alert entirely so it no longer consumes space in the Security Overview and cannot be reopened by future scans.

Answer

Disable code scanning for the repository until after the release, then re-enable it so the alert count resets to zero.

Answer

Leave the alert open but merge the pull request anyway, since open alerts have no effect on the alert history or compliance reporting.