Which security checks belong in the pipeline, and what makes them useful rather than noise?

What belongs

1. Dependency vulnerability scanning, with the results filtered by whether the vulnerable code path is reachable. Unfiltered, this produces the largest volume of findings and the lowest signal.

2. Secret scanning, blocking on a credential in a commit — and paired with automatic revocation for anything that reaches a public repository, because detection without revocation only tells you it is too late.

3. Static analysis for the high-confidence categories — injection, unsafe deserialisation, path traversal. Tuned to high precision even at the cost of recall, because a noisy scanner is disabled.

4. Policy checks — encryption, network exposure, region, resource types — which are deterministic and belong as guardrails rather than as findings.

5. Container and base image scanning, with the rebuild path automated so a fix reaches the fleet.

6. Provenance verification at deployment, refusing artefacts whose attestation does not match policy.

What makes them useful rather than noise

Prioritisation by exploitability and blast radius, not by scanner severity. A ranked list of forty findings means starting nowhere; an internet-facing service holding customer data outranks an internal tool behind a VPN with the same nominal finding, and applying this usually reduces the urgent list by an order of magnitude.

Fixing classes rather than instances. Two hundred findings of the same type is one platform change — a shared library, a base image, a service template — not two hundred tickets.

Blocking only on the high-confidence, high-consequence set. Everything else informs. A scanner that blocks on low-confidence findings is disabled within a month, after which it provides nothing.

Ownership attached automatically, since unowned findings are never fixed.

The structural point

Detective controls scale with headcount; preventive controls scale with automation. Pipeline scanning is detective, so beyond a certain estate size the backlog grows faster than it is cleared — which is why the highest-consequence categories should be preventive guardrails and secure defaults rather than findings.