Best Practices for Structuring DefectDojo Across Multiple Dev Teams in Large Companies
Hey whats a common structure for companies with many dev teams using defect dojo? This is what I'm trying to build out. Am I misunderstanding conventions? Is there a better way?
GH org
└── Product Team: team-platform ← GitHub team / CODEOWNERS
└── Product: owner/risce ← one repo
├── Engagement CI/main ← baseline (reimport)
│ ├── Test: Trivy Scan
│ ├── Test: Gitleaks Scan
│ └── Test: Semgrep ...
├── Engagement CI/PR-482 ← this PR only (import, then close)
│ └── same Tests