False Positives in SAST — How I Built Suppression Into My Scanner and Why It Matters

There's a failure mode that kills security tooling programmes quietly, without drama, and it's not a technical failure. It's a trust failure. It goes like this: a team enables a SAST scanner. The scanner fires on 200 things. Engineers triage 40 of them and discover that 25 are false positives. They fix the 15 real findings, suppress the 25 false positives, and then face another 160 findings they haven't looked at yet. Two sprints later, nobody is triaging anymore. The scanner still runs. The rep