Internal platform / SAST migration & triage

CodeQL Reporting

Finastra's move from Checkmarx to GitHub CodeQL exposed two operational gaps — CodeQL produces no detailed report equivalent, and GitHub's alert view cannot filter findings product teams have asked to dismiss — while high false-positive volume eroded trust in the new scanner.

Built with Go / React Integrated signals GitHub CodeQL / SARIF / GitHub code scanning API / LLM triage Source private — details on request

My contribution Led the Checkmarx-to-CodeQL migration end to end and designed and built the reporting platform and AI triage layer.

Problem

Checkmarx scans source as it sits in the repository. CodeQL has to observe a build. That single difference made Finastra’s migration a program rather than a tool swap: rolling CodeQL out across 80+ products meant getting large, long-lived codebases building reliably in CI, through long iteration with GitHub’s CodeQL and support teams.

Getting scans running was only half the problem. Two gaps made the results hard to operate. CodeQL has no equivalent of the detailed report Checkmarx produced for stakeholders, and GitHub’s vulnerability view has no native filter for findings a product team has requested to dismiss — so the review queue that mattered most was invisible. Then came volume: far more findings than teams had seen before, most of them false positives. Product teams pushed back, and the migration’s credibility was on the line.

Architecture decision

CodeQL Reporting is a Go backend with a React frontend, built around the two workflow gaps rather than around the scanner. It generates the detailed, shareable reports CodeQL lacks, and it turns dismissal requests into a first-class review queue — the state GitHub’s own view cannot show.

The second layer addresses volume. For every repository, the platform downloads the CodeQL SARIF, reconstructs the actual source code along each finding’s source-to-sink path, and sends that evidence — not just the alert metadata — to an LLM for triage. The model’s verdict is grounded in the same data flow a human reviewer would trace, which is what makes the triage defensible rather than a black-box score.

Outcome

The platform became the operating surface for the migration: reporting stakeholders could consume, a dismissal queue reviewers could actually work, and a triage layer that cut false-positive volume substantially. Specific reduction and adoption figures are pending approval for public use; this page will carry them once they are cleared.

← All projects