Integrating static analysis security testing into the developer workflow is hard. We discuss the challenges and how to overcome them