Problem
An internal audit and the implementation of a CVE-mitigation plan meant the engineering department needed static analysis (SAST) and secret scanning across all of its 700+ repos. The work ran from the October 2025 renewal to the end of a 30-day test in November 2025.
Approach
- Evaluated Snyk and GitHub Advanced Security, including secret scanning
- Chose GitHub Advanced Security for its integrations and to stay within a tool the department already used
- Negotiated annual contract rates directly with GitHub contacts, extending negotiations through the 30-day test
- Ran a 30-day test in partnership with GitHub, then got approval and enabled it org-wide
- Reviewed findings with the department heads responsible for teams with repos, then with each engineering manager for the repos their teams owned
Outcome
- SAST and secret scanning cover all 700+ engineering repos
- Every finding has an owner: the department head first, then the engineering manager for the repo