Blind SAST will give many false positives. It took a local megacorp a year to reduce noise on their Java build pipeline when adopting it.