How to roll out SAST: from the first scan to a merge block

API tests can be green while the source still concatenates user input into SQL. In AngusSecurity, Code security names the file and line, the security gate decides whether this merge stops or continues, and the next scan is what shows the line is gone.