DevSecOps pipeline gates: SAST, SCA, image and IaC scanning without blocking every PR
We added five scanners to CI and within a week developers were merging with admin override. This is the gate design we rebuilt: block only new, fixable, high-signal findings on PRs, scan everything nightly, and make exceptions expire.