High false-positive style findings drown out real security issues in city DevOps review. What is the main risk?
Select an answer to reveal the explanation.
Short Explanation
When the alarm blares for every crooked picture frame, folks stop running for real fires. Noisy style false positives make real security findings look like more noise.
Full Explanation
When high false-positive style findings drown out real security issues in city DevOps review, the main risk is trust collapse across categories. Developers learn that the bot cries wolf; they then skim or ignore the entire comment stream, including genuine security findings that needed attention. False-positive-heavy low-value categories therefore undermine trust in high-value findings even when those security comments were correct.
The idea that developers will always trust every finding more when volume increases fails: volume without precision trains disregard, not vigilance. Claiming security findings become stronger when mixed with noisy style nits fails because signal-to-noise ratio falls; mixing noise dilutes attention rather than amplifying security. Saying false positives only affect documentation and never code-review trust fails because the trust mechanism is shared—once the reviewer is tuned out, security comments in the same channel suffer too.
Exam caveat: trust erosion is the primary organizational risk; it is distinct from the technical presence of a true positive buried in noise—both matter, but exams often target the trust effect. Operational check: track ignore rates or unresolved security comments after noisy weeks, temporarily disable or rewrite the worst style category, and verify security findings regain response rates.