sast

Four scanners, four different things they see, and one rule that decides whether any of them help: a finding that arrives at the release gate is an argument, and the same finding on a pull request is a ten-minute fix.

Easy to define and easy to fail. The scoring half is where each gate sits, what it does to build time, and the honest admission of what the whole set misses.