We are using various scanners (SAST, Dependency, License, etc) and trying to come up with a sustainable way of keeping the various findings mitigated. We have a repo that has over 5000 findings, and there are so many of them that it would be MUCH easier to just reset it. Is there a way to do this?
The problem (we think) with just dismissing them all and waiting for the scanner to find the problems again, is that if we dismiss, for example, an “Object Injection Sink” vulnerability detected on line 46 of myjavascriptfile.js… then the tool seems to remember not to find that one again, and what we want is to wipe the memory of the vulnerability report itself, so that it will be starting from a completely blank slate, and it will again detect the OIS vulnerability on line 46 of myjavascriptfile.js. Otherwise we have to wait for every line of our repo to change (such as some code is added to myjavascriptfile.js so that the code triggering the OIS detection moves to line 47). Does that distinction make sense?
Any insight is appreciated. Thanks!