The GitHub Blog: Secure at every step: Putting DevSecOps into practice with code scanning

… a false positive rate of 10 percent or lower for results shown in pull requests, but achieving such a low false positive rate is hard. The solution? Don’t shift all security scanning left—noisier checks can continue to be run and reviewed by the security team, while high-precision ones are moved into the developer workflow. …