MODERNIZING LINKEDIN'S STATIC APPLICATION SECURITY TESTING CAPABILITIES TO PROTECT OUR MEMBERS

Summary from the TLDR InfoSec newsletter

LinkedIn modernized its SAST pipeline by building custom GitHub Actions workflows using CodeQL and Semgrep that deviated from paved paths to accommodate complex internal build processes, implementing dynamic rule filtering, SARIF enrichment, and extensive metrics instrumentation across tens of thousands of repositories. The team deployed a "stub workflow" approach combined with a Drift Management System that daily checks repository compliance and automatically commits workflow files, ensuring consistent security coverage while allowing centralized updates without touching individual repos. LinkedIn implemented "blocking mode" enforcement via GitHub Repository Rulesets requiring SARIF submission and zero high-risk vulnerabilities before PR merges, protected by multi-level kill switches (organization/repo/language/tool/rule-specific) and fail-safe mechanisms that upload blank SARIFs to unblock developers during scanning failures while triggering oncall alerts.