8.7Handling Security Findings

Severity-Based Response

Severity	SLA	Action
Critical (e.g., SQL injection, API key leak)	Block merge, fix immediately	PR cannot merge until fixed
High (e.g., XSS, vulnerable dependency)	Fix within 3 days	PR can merge with security team approval
Medium (e.g., missing headers, info disclosure)	Fix within 2 weeks	PR can merge, ticket created
Low (e.g., best practice violation)	Fix in next sprint	No merge block, warning only

False Positive Management

SAST tools produce false positives. Manage them systematically:

# .semgrep-ignore.yaml
rules:
  - id: no-output-sanitization
    paths:
      # Internal tools that only display to admins
      - src/admin/debug_panel.py
    comment: "Admin debug panel, no user-facing output"
    approved_by: "security-team"
    approved_date: "2026-01-15"

Track your false positive rate. If it exceeds 20%, the team will stop trusting the tool. Tune rules to reduce noise while maintaining detection capability.

A security pipeline is not set-and-forget. Review findings weekly, update rules monthly, and re-evaluate tool effectiveness quarterly.