https://docs.veracode.com/updates Veracode Docs Blog 2026-08-10T00:00:00.000Z https://github.com/jpmonette/feed Veracode Docs Blog https://docs.veracode.com/img/veracode-favicon.png Copyright © 2026 Facebook, Inc. <![CDATA[About product updates]]> https://docs.veracode.com/updates/r/c_release_notes 2026-08-10T00:00:00.000Z Review the product updates for the latest features, enhancements, important announcements, and release notes for Veracode products and services. Subscribe to all posts with the RSS feed Feed-icon.png.

Veracode regions​

Your Veracode account is in one of three Veracode regions. Some updates might only be available in specific regions. For example, an update that only applies to a specific product in the Commercial region, or an early release that is first available in the European region, then available in all regions.

If you do not know the region for your account, contact the Veracode Administrator for your organization.

Region icons​

By default, all product updates are available in all regions. To indicate that a product update applies to specific regions, it shows one or more of the following icons. Updates that are available in all regions do not show icons.

      Commercial region

      European region

      United States Federal region

Security Labs is only supported in the Commercial region.

Downloads​

To download the latest Veracode integrations, see Integrate with Veracode or go to Veracode Community Open Source Projects.

]]> <![CDATA[CLI updates]]> https://docs.veracode.com/updates/r/Veracode_CLI_Updates 2026-09-23T00:00:00.000Z The updates on this page apply to the Veracode CLI. Subscribe to the CLI updates RSS feed Feed-icon.png.

Updates that apply to specific Veracode regions show a region icon.

For updates specific to Veracode Fix, such as language and CWE support, see Fix updates.

September 23, 2026​

Veracode CLI v2.52.1​

The veracode fix sca command has performance improvements for JavaScript projects.

August 31, 2026​

Veracode CLI v2.52.0​

This update includes the following improvements:

  • The veracode scan command improves container image scanning by resolving a deadlock that caused scans to fail or become unresponsive.
  • The veracode package command excludes artifacts from Gradle dependency folders.
  • The veracode package discover command detects toolchains for JavaScript projects that use npm or Yarn.
  • The veracode fix sca command generates fixes for vulnerable dependencies identified in Software Composition Analysis (SCA) scans. This is a Limited Availability (LA) feature available only to specific Veracode customers. For more information, see veracode fix sca.

July 31, 2026​

Veracode CLI v2.51.2​

This update includes the following improvements:

  • The veracode scan command has improved policy enforcement to ensure vulnerability severity thresholds are consistently applied.
  • The veracode fix command includes enhanced batch fix processing and fix application capabilities, enabling the remediation of a large number of vulnerabilities in a single batch operation.

July 17, 2026​

Veracode CLI v2.51.1​

This update includes the following improvements to the veracode package command:

  • Improved packaging support for JavaScript, .NET, and Java (Gradle)
  • Removed unnecessary warnings in Go packaging

July 3, 2026​

Veracode CLI v2.51.0​

This update includes the following improvements:

  • The veracode scan command:
    • Introduces schema enhancements for container and IaC scan results.
    • Deletes all temporary files after container scans complete to reduce disk usage.
  • The veracode dynamic scan command now supports target UUIDs for triggering scans. You can continue to use webhook UUIDs.
  • Veracode collects anonymized, aggregated usage data to improve product quality.
  • The veracode package command:
    • Enhances SQL dialect packaging.
    • Improves .NET packaging to increase scan coverage.
    • Adds the --exclude flag, which prevents specified Java packages or JAR files from being scanned.
    • Enhances packaging support for veracode.json.

June 2, 2026​

Veracode CLI v2.50.0​

This update includes the following improvements:

  • The veracode policy command now automatically determines and generates appropriate output artifacts based on the policy created. No changes are required to existing workflows.

  • The veracode package command includes the following improvements:

    • For .Net, the command's output logs refers to user’s original projects rather than temporary build directories, making failures and warnings easier to understand.
    • The command has OpenWrt improvements and fixes.

April 21, 2026​

Veracode CLI v2.49.0​

This update includes the following improvements to the veracode package command:

  • Introduces exit codes 5, 6, and 7 to better automate CI/CD pipelines, improve error handling, and quickly identify packaging or build issues. For details, see CLI exit codes.
  • Provides enhanced SQL packaging detection in the Static Packager to better identify supported and unsupported SQL dialects during packaging.

April 13, 2026​

Veracode CLI v2.48.0​

This update includes the following improvements:

  • The veracode scan command delivers enhanced user experience in the Veracode Platform.
    Important

    If you use the old CLI versions, you will see incomplete data in the Veracode Platform.

  • The veracode package command:
    • Introduces the --skip-packagers flag to exclude specific artifacts, such as unsupported SQL, from packaging results without affecting artifacts in other languages.
    • Adds support for requirements-dev.txt in Python packaging workflows to enable the inclusion of development dependencies in the packaging process.
    • Resolves build failures in .NET projects where submodules contain Node.js artifacts.
    • Improves control over the scan by ensuring skip-packager settings work as expected to package only the relevant components.
  • The veracode repository add command improves the accuracy and performance of the repository add command on GitLab by running faster, preventing timeouts or hangs, and ensuring consistent results for large repositories.
  • The veracode package discover command introduces exit codes.

March 13, 2026​

Veracode CLI v2.47.0​

This update includes the following improvements:

  • The veracode scan returns more precise findings by reducing false positives.
  • The veracode package command:
    • Supports the Poetry package management tool in Python for autopackaging.
    • Improves the handling of permission-restricted directories by logging user-friendly warnings.
    • Resolves issues when packaging preprocessed C/C++ using Make in OpenWrt.

February 18, 2026​

Veracode CLI v2.46.0​

This update includes the following improvements:

  • The veracode package command supports Java source code packaging using the --java-source flag and the VERACODE_PACKAGE_JAVA_SOURCE=true environment variable.
  • The veracode package discover command provides toolchain detection for Java projects that use the Gradle package manager.

February 2, 2026​

Veracode CLI v2.45.0​

This update includes the following improvements:

  • All Veracode CLI commands can consistently read access tokens from the disk.
  • The veracode scan command:
    • Categorizes secret-type findings as Critical in the scan results.
    • Prioritizes vulnerability results from the NVD database, if available.

December 24, 2025​

Veracode CLI v2.44.0​

Note
Recently, Veracode container scans began failing due to a breaking change from one of our upstream data suppliers. This breaking change affected all versions of the Veracode CLI, including 2.43.0 and earlier.

Veracode has expedited a new Container & IaC release to address the issue and recommends all customers upgrade to the latest release immediately.

This breaking change only affected Container & IaC scanning. Other functions of the Veracode CLI, including Static scanning and Veracode Fix, were not affected.

This update includes the following improvements:

  • The veracode scan command:
    • Allows you to apply a custom policy defined in the Veracode Platform.
    • Enables you to view policy evaluation for individual findings along with the overall policy result.
    • Introduces changes to the scan results schema.
    • Increases vulnerability coverage to improve scan performance.
    • Creates a separate asset for each repository in the ADO workflow, making it easier to track and view individual scan results.
  • Introduces the veracode package discover command to detect the toolchains required to successfully create scannable artifacts.
  • The veracode package command:
    • Produces no artifacts if the Python virtual environment is at the repository root. If it’s in a subdirectory or is a conda-meta environment, that directory is excluded from packaging.
    • Expects the python-no-pm artifact to be created from the root of the repository.
    • For .NET, passes TargetFrameworkVersion to the msbuild publish command only when multiple target framework versions are specified.
    • Preserves the source file name extension of preprocessed output files.
    • Improves logging of solution configuration and platform selection.
    • Eliminates an issue detecting the version of CL.exe from a legacy toolset when using a newer build environment.
    • Corrects an issue building projects with names containing ( or ) characters.
    • Prevents packaging failures when the input directory contains both supported and unsupported solutions.
    • Adds support for preprocessing C/C++ source files with Make on Windows using a native Windows gcc or clang compiler, via the SRCLR_MAKE_WINDOWS environment variable.

October 30, 2025​

Veracode CLI v2.43.0​

This update includes the following improvements:

  • The veracode scan command has security related updates.
  • The veracode package command:
    • Supports generic packager for Apex.
    • Includes fixes to stop the creation of a Golang zip artifact when only the go.mod file is present.
    • Adds the new VERACODE_PACKAGE_GOLANG_GENERATE environment variable, which enables client-side CGO code generation when packaging Go applications.
  • The veracode static command includes fixes for the usability of --filtered-json-output-file to work like --results-file.
  • The veracode fix CLI includes minor updates.

Aug 1, 2025​

Veracode CLI v2.42.0​

This update includes the following improvements:

  • Improves error messaging when a user cannot be authenticated.
  • The veracode static scan command:
    • Displays the Static Engine version in the scan summary.
    • Provides enhanced logging.
  • The veracode package command:
    • Resolves packaging errors for C++/CLI and C++/CX projects that produce static libraries.
    • Resolves MSBuild errors for C/C++ projects that contain a . in the name.
    • Improves detection of Makefiles generated by Autoconf to reduce autopackaging errors.
    • Provides packaging support for the MSBuild .NET framework.
  • The veracode scan command:
    • Adds platform integration support for scenarios where the scan path is specified as relative. For example, ./.

July 1, 2025​

Veracode CLI v2.41.0​

This update includes the following improvements:

  • The veracode package command has the following updates and improved capabilities:

    • Adds the ability to include the directory path in the artifact name to make flaws easier to locate.
    • Skips creating a JS artifact if the artifact contains only these extensions: json, map, yaml, yml, lock, css.
    • Fixes Maven build failure caused by the directory tag in pom.xml. Scannable artifacts are now created only in the target directory.
    • Adds support for preprocessor header files used to build PCH.
    • Packages C++/CLI and C++/CX projects as binaries when packaging preprocessed source.
    • Adds the option to process all Makefiles in a directory tree.

  • The veracode scan command includes the following improvements:

    • Enables customers to specify a custom location from which vulnerability databases can be downloaded.
    • Provides supports for parsing Dockerfile heredoc syntaxes.

  • The veracode repository report command fixes the issue of duplicate email address being counted twice.

  • The veracode sca command that includes SBOM generation is now supported via SCA agent-based scans. Results can be published in CycloneDX 1.6 and SPDX 2.3 formats.

  • Introduces auth login command to seamlessly onboard new users via oAuth2.

May 16, 2025​

Veracode CLI v2.40.0​

This update includes the following improvements:

  • The veracode package command includes:

    • Improved messaging for build issues during packaging.
    • Support for Go v1.24.

  • The veracode scan command includes updated dependencies for improved security.

April 14, 2025​

Veracode CLI v2.39.0​

This update includes the following improvements:

  • The veracode package command includes:

    • New configuration options for specifying platform and build configuration for C/C++ on Linux and Windows.
    • Improved packaging support for Golang and Ruby projects.
    • The SRCCLR_DOWNLOAD_URL environment variable now defaults to https://sca-downloads.veracode.com. The previous URL, https://download.sourceclear.com, is now deprecated. We recommend updating all instances in your environment.
    • Autopackager debug logs now include Maven project exit codes.
    • A new, optional --strict flag: when enabled, the CLI returns exit code 4 for any build failures during packaging.
    • Preprocessed source code scanning is now the default method for C/C++ projects on Windows. This change offers broader support and faster scan times.
    • Support for scanning preprocessed C/C++ source code is now available on Linux, replacing the existing Linux autopackaging solution.

  • The veracode scan command includes:

    • Improved detection of misconfigured environments
    • A new schema that improves the organization and presentation of scan results

March 13, 2025​

Veracode CLI v2.38.2​

This update includes the following improvements:

  • The veracode static scan command no longer includes the --verbose flag, by default.

  • The veracode package command includes:

    • Improved logging and warning messages.
    • Support for identifying the Go version specified in the go.mod file.
    • Support for .NET 9.
    • Improved support for atypical .NET projects, such as mixed SDK-style.
    • Builds that use Microsoft C++ (MSVC) compilers now succeed, even if there are warning messages.

  • The veracode repository add command now supports larger data types (Int64).

February 21, 2025​

Veracode CLI v2.38.0​

This update includes the following improvements:

  • Added the --verbose flag to the veracode package command. The --debug flag is now deprecated, but still available for compatibility. Use --verbose instead.
  • The veracode static scan command now retries failed scans up to five times when server errors or too many requests occur.

January 13, 2025​

Veracode CLI v2.37.0​

This update includes the following improvements:

  • You can now install the CLI on Windows using a signed Microsoft Standard Installer (MSI) file.

  • The CLI now prompts you when a new version of the CLI is available.

  • The CLI now displays a progress indicator when commands are running.

  • The veracode package command includes:

    • Autopackaging for .NET MAUI framework, .NET Blazor WebAssembly, Azure functions in .NET projects, and .publishproj file types in .NET frameworks.
    • Improved logging.

  • The veracode scan command no longer generates extraneous files in the working directory.

November 20, 2024​

Veracode CLI v2.36.0​

This update includes the following improvements:

  • The veracode package command includes:

    • Improved logging.
    • The autopackager attempts to generate artifacts for .NET projects even if it encounters warnings.
    • The autopackager now ignores gems when packaging Ruby projects.

  • The veracode scan command now takes less time to generate output.

October 24, 2024​

Veracode CLI v2.35.0​

This update includes the following improvements to the veracode package command:

  • If your Python, JavaScript, or PHP projects do not use a package manager, this command now generates artifacts that include all code files that might be omitted by a package manager. The artifact filename contains no-pm.
  • Minor performance improvements.

October 15, 2024​

Veracode CLI v2.34.0​

This update includes the following improvements:

  • New veracode cache command clears the cache for all commands.

  • The veracode scan command includes:

    • To improve secrets detection, adds support for custom keywords and regex patterns, based on the policy for your organization.
    • If policy passed is false, the CLI now exits with code 3.
    • Support for defining a temp directory.

September 25, 2024​

Veracode CLI v2.33.0​

This update includes support for installing previous versions of the CLI using Homebrew.

September 16, 2024​

Veracode CLI v2.32.0​

This update includes the following improvements:

  • The veracode package command includes:

    • Support for PL/SQL and T-SQL.
    • Improved packaging for Python and PHP.
    • Improved error handling.
    • Improved packaging for iOS to support the latest release of gen-ir.
    • Improved packaging for .NET to include EXE files.
    • Improved JavaScript packaging on Windows.

  • The veracode scan command adds a --verbose flag to show debug logs.

September 09, 2024​

Veracode CLI v2.31.0​

This update includes the following improvements:

  • The veracode package command has improved packaging for JavaScript.
  • The veracode package command now excludes nested Go modules when packaging Go projects.
  • The veracode scan command has improved logging for .NET projects.
  • The veracode scan command can now scan SBOMs from an SCA agent-based scan or upload scan.
  • Added the proxyUrl parameter to a CLI installation script for PowerShell. You can use the parameter to configure proxy servers during the installation.

August 28, 2024​

Veracode CLI v2.30.1​

You can now install and access the CLI using Homebrew.

August 27, 2024​

Veracode CLI v2.30.0​

This update includes the following improvements to the veracode package, veracode sbom and veracode scan commands:

  • Improved language support for Java Maven workflow.
  • Improved error handling to show fatal errors in all modes. For debug mode, added guidance to contact Veracode Technical Support.

August 1, 2024​

Veracode CLI v2.29.0​

This update includes the following improvements to the veracode package, veracode sbom and veracode scan commands:

  • Streamlined the log output by removing overly detailed logs that were cluttering the console. This change improves readability and helps users focus on the most relevant information during the execution of commands. Detailed logs are still available using the --debug flag.
  • Windows C/C++ packaging improvements, including parallel project builds, skipping non-C/C++ projects, and enhanced logging for failed builds.
  • Improved error messaging.
  • Updated the Syft JSON schema from version 13.0.0 to 16.0.4.
  • Updated the CycloneDX XML schema from version 1.5 to 1.6.
  • URL encoder is applied.

July 25, 2024​

Veracode CLI v2.28.0​

This update includes the following improvements:

  • The veracode static scan command has improved error messages that indicate whether API credentials are missing or invalid.
  • The veracode configure command now correctly uses directory paths that contain environment variables.
  • General performance improvements.

July 2, 2024​

Veracode CLI v2.27.1​

This update includes the following improvements to the veracode package command:

  • Support for C/C++ Windows, C/C++ Linux, COBOL, and Perl.
  • Support for multiple target frameworks defined in the *.csproj, Directory.Packages.props, and Directory.Build.props files in .NET projects.
  • Improved language support for .NET.

June 28, 2024​

Veracode CLI v2.26.0​

This update includes the following improvements to the veracode package command:

  • Support for .NET Framework 4.6-4.8.
  • Support for restoring .NET projects with <TargetFramework>.
  • Improved language support for Flutter, Android, PHP, and .NET.
  • More meaningful --debug messages if the command is not able to locate required build or packaging tools.

June 18, 2024​

Veracode CLI v2.25.0​

This update includes the following improvements

  • The veracode package and veracode scan commands are now supported on alpine-based environments.
  • Improved Java, Javascript, and Python language support for the veracode package command.

June 12, 2024​

Veracode CLI v2.24.0​

The veracode static command now provides improved command output.

June 6, 2024​

Veracode CLI v2.23.0​

The veracode static command output now only displays scannable modules once.

June 5, 2024​

Veracode CLI v2.22.0​

This update adds the veracode dynamic command. You use this command to run a DAST Essentials dynamic analysis, check the status of the analysis, and output the results.

May 28, 2024​

Veracode CLI v2.21.0​

The veracode package command now supports Android, React Native, Dart, and Flutter.

May 6, 2024​

Veracode CLI v2.18.0​

This update includes the following improvements to the veracode package command:

  • Support for streaming log messages.
  • Improved language support for .NET and Python.

April 15, 2024​

Veracode CLI v2.16.0​

This update includes the following improvements:

  • The veracode package command now supports iOS, in addition to existing support for Java, JavaScript, .NET, Python, PHP, Scala, Kotlin, Go, and Ruby on Rails. You use this command to autopackage your applications for Static Analysis and Software Composition Analysis (SCA) upload scans.
  • The packaged artifacts use a Veracode approved filename format.
  • Improved error messaging.
  • The veracode package command output now displays the installed CLI version.

March 29, 2024​

Fix flaws in multiple files in a directory​

The veracode fix command now provides suggested fixes for a directory of source files, in addition to a single source file. You can fix flaws in multiple files as a batch, without having to rescan your code each time you apply a fix.

March 27, 2024​

Veracode CLI v2.14.0​

The veracode package command now supports application packaging for the following languages:

  • .NET
  • Go
  • Kotlin
  • PHP
  • Ruby on Rails
  • Scala

February 5, 2024​

New commands for reporting on repository contributors​

The Veracode CLI now includes the following commands:

January 18, 2024​

The Veracode CLI now supports autopackaging for Veracode Static Analysis​

The Veracode CLI now supports Static Analysis autopackaging for Java, JavaScript, and Python. The package command removes manual packaging steps to streamline your application security tests.

January 9, 2024​

Install the CLI on Windows with a PowerShell script​

You can now install the Veracode CLI on Windows with a PowerShell script.

Previous updates​

2023 updates​

2023 updates

October 26, 2023​

The Veracode CLI now supports Windows​

You can now install the Veracode CLI on Windows with Chocolatey.

June 28, 2023​

New command for Veracode Fix​

The veracode fix command is a new generative AI feature of the Veracode CLI. It uses the results from a Veracode Pipeline Scan to generate suggested code fixes that you can apply to flaws in your application source code. This feature is currently only available in the Commercial Region. To get started, see the quickstart.

2022 updates​

2022 updates

December 30, 2022​

Released Veracode Container Security​

Veracode Container Security is available. Container Security is a feature of the Veracode CLI that does the following:

  • Scans for container vulnerabilities
  • Scans for infrastructure as code misconfigurations
  • Scans for improperly stored secrets
  • Helps developers secure their cloud native applications

For more information about Veracode Container Security, contact your Veracode account representative.

]]> <![CDATA[DAST updates]]> https://docs.veracode.com/updates/r/c_all_was 2026-09-23T00:00:00.000Z The updates on this page apply to the following Veracode Dynamic Application Security Testing (DAST) products and features. Subscribe to the DAST updates RSS feed Feed-icon.png.

Updates that apply to specific Veracode regions show a region icon.

September 23, 2026​

Assign multiple teams for DAST targets​

You can now assign multiple teams to a DAST target when creating a web application or API specification. This allows your teams to collaborate more effectively on security ownership.

August 6, 2026​

Business unit and scan engine enhancements​

You can now select a business unit when creating a web application or API specification target, or on the DAST configuration page.

The scan engine now provides improved detection for CAA record checks on SSL certificates for CWE-862 in both Dynamic Analysis and DAST.

July 22, 2026​

DAST custom host-to-IP address mappings​

You can now configure a custom host to define host-to-IP address mappings for DAST scans when DNS lookup is unavailable or not desired.

June 26, 2026​

ISM endpoint 26.6.1​

This release includes security updates that resolve vulnerabilities identified in previous versions of the ISM endpoint.

June 24, 2026​

New DAST Directory Restrictions and Schedule enhancements​

You can now define Directory Restrictions in your target configuration to control the scan scope.

We have enhanced the DAST Schedule feature with advanced scheduling capabilities. This update provides enhanced configuration options and greater flexibility for managing scan schedules.

The system automatically migrates all existing DAST schedules to enhanced schedules. After migration, scans continue to run using the enhanced scheduling feature.

Breaking change - DAST REST API​

The scheduling API endpoints have changed. If you use the REST API to manage a schedule, update your integrations to use the new endpoints. Refer to the DAST API specification for details.

ISM endpoint 26.6.0​

This release includes security updates that resolve vulnerabilities identified in previous versions of the ISM endpoint.

May 26, 2026​

ISM endpoint 26.5.0​

This update addresses security vulnerabilities identified in earlier versions. It includes patches to resolve security risks and strengthen system protection for security compliance.

April 28, 2026​

DAST Full scan targets are migrating to Full scan Enterprise​

As part of the ongoing scan engine consolidation, we are migrating all DAST targets that use the deprecated Full scan to Full scan Enterprise. After the migration, new analyses for migrated targets use Full scan Enterprise. Historical scan data remains unchanged.

March 3, 2026​

DAST Essentials rebranded to Veracode DAST​

DAST Essentials is officially rebranded to Veracode DAST. This is a name change only and does not impact product features, functionality, or capabilities.

February 25, 2026​

ISM endpoint 26.2.0​

This update introduces improvements to the handling of large static files, including JavaScript assets, to prevent parsing errors during scans and reduce intermittent failures, particularly during authentication workflows.

February 12, 2026​

DAST target creation now uses Enterprise mode by default​

DAST target creation has been simplified and now uses Full scan Enterprise mode by default. The legacy Full scan option is deprecated and is no longer available when creating new targets or configuring Quick scan targets. Existing targets that use legacy Full scan will continue to function. However, we recommend migrating these targets to Full scan Enterprise mode.

January 22, 2026​

Scan engine updates​

Dynamic Analysis and DAST Enterprise Mode now support scanning web applications for open ports. The scan engine also includes new detections for HTTP headers, TLS, and fingerprinting. These updates will be rolled out gradually.

November 28, 2025​

End of life for Discovery scans​

Veracode is announcing the end of life for Discovery scans. Discovery scans will no longer be available or supported.

September 17, 2025​

DAST supports application linking​

DAST now supports manual application linking. This feature lets you link analysis run results to an application in the Veracode Platform to evaluate against policy and combine results from multiple scan types in a single report.

August 28, 2025​

Updated the UI for DAST Analysis Run page​

DAST Analysis Run page is refreshed with a clean, modern user interface. The updated design makes the page easier to use without changing existing workflows.

June 30, 2025​

Added EASM integration with DAST​

EASM now automatically creates discovered targets in DAST. You can map these targets or convert them to regular DAST targets for scanning.

June 9, 2025​

Enhanced reporting capabilities in DAST Enterprise mode​

DAST Enterprise mode now supports downloadable scan reports. These reports provide greater visibility into scan coverage and scanner behavior.

May 20, 2025​

ISM endpoint 25.5.0​

This update introduces a fix for an issue in which virtual threads could occasionally become starved under high load.

April 28, 2025​

DAST AI-assisted login​

DAST Enterprise mode now provides an AI-based authentication method to sign in to web applications. Even complex login flows that previously required recorded login scripts can now be covered by configuring AI-Assisted Login instead.

March 27, 2025​

DAST Enterprise mode​

DAST Enterprise mode is now available. It enhances the security testing of web applications and APIs by integrating with the Veracode Platform, significantly improving policy enforcement and analytics. Analyses conducted using Enterprise mode offer the following benefits:

  • Additional authentication configuration: Includes support for login scripts, scanner variables, and client certificates for web applications, as well as Scriptable Request Modifications (SRM) for APIs.
  • Improved API specification management: Users can now upload or dynamically reference API specifications with ease.
  • Internal Scanning Management (ISM): Enables scanning of web applications and APIs hosted behind a corporate firewall.

October 22, 2024​

ISM endpoint 24.10.0​

This update introduces the proxy exclusion list, which includes hosts that bypass the configured proxy settings. By default, all traffic routes through the proxy except for hosts on the exclusion list.

September 19, 2024​

Public REST API for DAST​

The DAST Target Configuration Service REST API is now available. Use this API to automate the management of DAST targets and trigger analyses.

July 15, 2024​

Improved target configuration pages in DAST​

DAST has a new look and feel for target configuration. Additionally, you can now switch between non-invasive quick scans and invasive full scans.

June 27, 2024​

API Scanning now supports Postman Collections​

You can now upload and scan Postman Collections in the Veracode Platform.

May 15, 2024​

ISM endpoint 24.5.5​

This update includes performance improvements to Internal Scanning Management (ISM). To install this endpoint, you must have Java 21 or greater.

March 28, 2024​

Improved pause and resume scheduling​

You can now schedule an analysis to pause and resume on specific days of the week, during specific periods, or both.

Previous updates​

2023 updates​

2023 updates

December 19, 2023​

Web application and API scans now support multi-factor authentication​

You can now configure web application scans and API scans to use time-based one-time password (TOTP) seeds for URLs that require multi-factor authentication (MFA). You can also configure TOTP with the REST API.

December 12, 2023​

ISM endpoint 23.12.1​
  • The endpoint now supports Java 21.
  • Adds virtual threading functionality to improve performance and stability. Before you can use this functionality, you must upgrade to Java 21.

November 27, 2023​

Free trial of DAST​

Veracode now offers a free 14-day trial of DAST in the Veracode Platform. To sign up, on the Sign in page, select Sign Up to create your account. If you are a Veracode customer and want to try DAST, contact your sales associate.

November 15, 2023​

Introducing DAST​

DAST is a new Dynamic Application Security Testing (DAST) product that provides rapid and resilient DAST scanning of web applications and REST APIs, a user-friendly interface, and seamless CI/CD pipeline integration. To get started, see the quickstart.

September 25, 2023​

Web application and API scans now support custom cookies​

You can now configure web application scans and API scans to use one or more custom cookies for authentication.

May 9, 2023​

ISM endpoint 23.5.0​

Added executable scripts that update the JAVA_HOME path for the endpoint.

April 25, 2023​

ISM endpoint 23.4.2​
  • The endpoint now supports environments where the target host is on the same host as the client.
  • Source code files now include a copyright header.

February 27, 2023​

Set URL Scan Settings at the Organization Level​

You can now use the Dynamic Analysis REST API to set URL scan settings for all analyses and scans in an organization.

February 17, 2023​

New Manual Resume Feature for Paused Analyses​

Veracode Dynamic Analysis adds a new feature that enables you to manually resume a scheduled analysis from a paused state. This feature is only available upon request. To add this feature to your account, contact Veracode Technical Support.

January 20, 2023​

Renamed URL Scan Status Messages​

Veracode has renamed and changed the descriptions for the following URL scan status messages for Dynamic Analysis. The new names more accurately describe the issues that caused these status messages to appear in the Veracode Platform.

  • Killed - Partial Results Available is now Lockout - Partial Results Available.
  • Killed - Verifying Partial Results is now Lockout - Verifying Partial Results.

2022 updates​

2022 updates

December 19, 2022​

ISM endpoint 22.12.3​
  • Fixed an endpoint issue that caused threads to lock up until the ISM tunnel closes.
  • Improved endpoint logging that Veracode Technical Support can use for troubleshooting.

October 21, 2022​

ISM available for Dynamic Analysis ​

Internal Scanning Management (ISM) is now available for Veracode Dynamic Analysis of web applications and API specifications in the European region.

October 18, 2022​

API Scanning Adds Support for Scriptable Request Modification​

Veracode API Scanning adds a new option for using JavaScript to modify an HTTP request, at runtime, when authenticating with a remote host.

October 5, 2022​

New Similarity Threshold for Web Applications​

When configuring an analysis of a web application, you can now set a threshold for ignoring similar web pages during the analysis.

September 7, 2022​

Dynamic Analysis Now Creates Screenshots for Consecutive Login Failures​

The Veracode scan engine now creates a verification screenshot if it is unable to log in to a target application after 50 attempts. The screenshot image shows when and where in the scanning process the failed login attempts occurred. You can use this information for troubleshooting.

August 2, 2022​

New Historical Details for Dynamic Analyses and Scans​

You can now view detailed information about all past occurrences of both a dynamic analysis and its scans.

July 28, 2022​

Dynamic Analysis available for European region ​

Veracode Dynamic Analysis is now available in the European region. If you have a Veracode Dynamic Analysis subscription, you can now perform dynamic analysis security testing and API testing on public-facing web applications and APIs.

May 18, 2022​

Re-Enabled Pause and Resume for Scheduled Analyses​

When scheduling a Dynamic Analysis, you can now set it to pause and resume scanning at specific days and times. Veracode disabled this option on October 7, 2021.

April 28, 2022​

New Status Messages for Partial Scan Results​

Dynamic Analysis now provides status messages that indicate when Veracode is verifying partial results and when partial results are available for review. Partial results can occur when a scan stops prematurely due to:

  • Errors during scanning
  • Users stopping the scan early
  • The scan exceeding its configured duration

March 23, 2022​

API Scanning Adds Support for OpenID Connect to OAuth 2.0​

Veracode API Scanning adds a new option to specify an OpenID Connect URL when configuring OAuth 2.0 authentication.

March 10, 2022​

Dynamic Analysis Adds Support for Concurrent Browsers Running Dynamic Analysis Scans​

Veracode Dynamic Analysis now supports concurrent browsers for running multiple Dynamic Analysis scans at the same time. When configuring a web application scan, you can specify up to 12 concurrent browsers.

March 8, 2022​

API Scanning Adds OAuth 2.0 Authentication and Analysis History Options​

Veracode API Scanning includes these changes:

  • New option to configure OAuth 2.0 authentication for the API endpoints in your API specifications. You can select to use either the Client Credentials or Password Credentials grant type.
  • New Associated Analysis field on the API Specification Details page for a given API specification. This field provides options for viewing, reconfiguring, and rerunning previous scans.

March 3, 2022​

Dynamic Analysis Now Detects Log4j Vulnerability CWE-115​

Veracode Dynamic Analysis can now detect Log4j vulnerability CWE-115 when scanning web applications or API specifications.

February 4, 2022​

Updated Dynamic Analysis Scan Engine​

The Dynamic Analysis scan engine includes these updates:

  • Updated Chromium to version 98.0.4758.80
  • Log4j security updates
  • Improved connectivity when authenticating with Veracode
  • Fix for insecure cookies that prevented flaw matching

January 25, 2022​

ISM endpoint 22.1.10​
  • The endpoint upgraded to Log4j 2.17.1 to address security findings.
  • Improved thread management for connection stability.
  • Advanced memory usage diagnostics.

2021 updates​

2021 updates

December 21, 2021​

ISM endpoint 21.12.13​
  • The endpoint upgraded to Log4j 2.17 to address known vulnerabilities CVE-2021-44228 and CVE-2021-45046.
  • Additional libraries upgraded to address security findings.

2020 updates​

2020 updates

November 24, 2020​

New Target URL Search Feature​
  • Veracode Dynamic Analysis now allows you to search for individual URL scans in addition to searching for a specific Dynamic Analysis. This capability enables you to easily identify which scans are associated with a specified URL.
CSP Header Checks​
  • Veracode Dynamic Analysis now checks for missing or misconfigured script execution policies in Content Security Policy (CSP) headers of web applications.
  • Veracode Dynamic Analysis has expanded its list of known secure cookie attributes, such as SameSite, Secure, and HttpOnly, that are common to cloud infrastructures. Veracode checks web applications for secure cookie attributes on this list before reporting missing attributes as flaws.

August 10, 2020​

ISM endpoint 20.8.5​
  • The endpoint now supports not resolving the hostname when accessing the ISM gateway via proxy. This support enables you to only allow the gateway hostname for outbound HTTPS calls.
  • The endpoint now supports not resolving the hostname when accessing scanned URLs via proxy. This support simplifies proxy configuration if you do not want to access external sites, such as Okta, during the scan.
  • Improved interface for configuring a proxy for the endpoint installer.
  • The endpoint installer supports configuring hostname resolution properties.
  • Java WebSocket library for the endpoint upgraded to version 1.5.1.
  • The endpoint supports specifying non-default network interface via endpoint properties, including the option to see a list of available network interfaces.
  • The endpoint process name on Linux includes a Veracode identifier.
  • Improved endpoint logging.

For more information, see the endpoint release history

July 22, 2020​

New Video - Configure Dynamic Analysis Login Settings​
  • This video describes the different types of authentication that Veracode Dynamic Analysis can require to log in to your application and how to configure your Dynamic Analysis so that Veracode can log in.

June 11, 2020​

Crawl Script Support for Comprehensive Scans​
  • Veracode Dynamic Analysis now supports the use of prerecorded crawl sequences to supplement the default automated crawling capability of the Veracode scan engine. You must use Selenium to record the crawl scripts and save them in SIDE test suite or HTML formats. Dynamic Analysis runs the crawl script during prescan to check for any commands that might fail during the URL scan.

June 8, 2020​

Improved Dynamic Analysis Coverage​

Veracode has improved the scan engine coverage with:

  • Increased coverage for CWE 89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection).
  • Increased reporting for SSL issues and updated description and remediation text. The Dynamic Analysis scan engine now reports the use of Cipher Block Chaining (CBC) ciphers, and key exchange algorithms that do not provide perfect forward secrecy (such as RSA with no EDH).
New Screenshot Verifications and Scan Notes Features​
  • Veracode Dynamic Analysis now shows additional troubleshooting information on the Prescan Details and Scan Details pages. The new Verification Screenshots section shows screenshots that the Veracode scan engine takes at predetermined points. The Scan Notes section contains observations from the scan engine on issues encountered at runtime or best practices that you can apply to the scan configuration.
Updated Video - Initiate a Dynamic Analysis Prescan​
  • This video shows you how to submit a Dynamic Analysis for prescan, what the Dynamic Analysis is testing during prescan, and how to tell if your Dynamic Analysis has passed prescan successfully.

May 26, 2020​

Enhanced Access Control for ISM Endpoints​
  • Veracode Dynamic Analysis Internal Scanning Management (ISM) provides new options for granting Veracode support engineers access to your endpoints. You can now allow support access for a specific number of days, up to 30, or allow access indefinitely until you choose to disable it.

May 21, 2020​

Client Certificate Authentication Support​
  • Dynamic Analysis now supports client certificate-based authentication. When you upload your certificate and the associated password, Veracode can log in to websites that require this method of authentication.
Engine JSON Web Token and Obsolete JavaScript Support​
  • Dynamic Analysis has added security auditing for JSON Web Tokens (JWT) and obsolete JavaScript resources. JWT auditing detects common flaws, including signature vulnerabilities, in sites that use JWT for authentication. Obsolete JavaScript resource detection reports known-vulnerable libraries, such as older versions of jQuery, through signature matching.
Improved Scan Status Details​
  • Veracode Dynamic Analysis now has improved end-user visibility into scan statuses. Additional status information is available in the status fields and columns of the All Analyses, Dynamic Analysis Summary, and URL Scan Summary pages. You now have more detailed information when scans stop due to network issues or because they exceeded the allocated scan duration time.
Updated Video - Create Login Scripts with Selenium​
  • This video shows you how to use the Selenium IDE plugin to create a login sequence script that enables Veracode Dynamic Analysis to scan URLs that have form-based authentication.

May 7, 2020​

Prescan Workflow Improvements​

Veracode has released several improvements to the Dynamic Analysis workflow to enhance these user experiences:

  • The prescan option has moved to the Schedule page. In addition, you can now use the new prescan-only option if you want to verify your configuration before submitting the analysis.
  • There is a new option on the Schedule page to enable you to save your Dynamic Analysis configuration and continue working on it or submitting it later.
  • Icons have replaced the menu in the individual rows of the URLs table, providing greater ease of use when you want to edit the configuration, link to an application, or delete the URL.

April 28, 2020​

ISM Notifications Include Endpoint Names​
  • Emails from Veracode about your ISM endpoints now specify the endpoint names to help with troubleshooting.

April 16, 2020​

Scheduling Improvement​
  • Veracode Dynamic Analysis now provides the ability to select a start date up to 90 days in the future. This enhancement enables you to initiate a one-time scan immediately as well as schedule a recurring, quarterly scan of the same Dynamic Analysis.
Update to Supported Selenium Commands​
  • Dynamic Analysis now supports these Selenium commands: keyUp, keyDown, keyPress, assertTextPresent, waitForElementVisibile, and clickAt.

March 31, 2020​

Dynamic Analysis User Agent Defaults to Chrome​
  • When configuring a Dynamic Analysis, if you do not provide a user agent string for a browser of your choice, the user agent value now defaults to the Chrome browser.

March 30, 2020​

Auto-Linking Now Available in Dynamic Analysis​
  • Veracode Dynamic Analysis now supports application auto-linking automation at the organization account level. Auto-linking links a Dynamic Analysis scan to an existing application profile. Auto-linking can also automatically create a new application profile to which Dynamic Analysis can link future scans, if you select that option. Linking a Dynamic Analysis to an application enables you to review the policy evaluation, download PDF results, and access the Veracode Links Report.

March 26, 2020​

Screenshot Provided for Login Script Errors​
  • Veracode Dynamic Analysis now provides troubleshooting information for login script authentication failures. If you have provided a login script, the Prescan Details window links to a screenshot of the associated login errors.

March 17, 2020​

Server-Side Request Forgery (SSRF) Attack Support​
  • Veracode Dynamic Analysis now enables Server-side Request Forgery (SSRF) attacks to find flaws, by default.
Extended Auto-Login Support​
  • The Veracode Dynamic Analysis scan engine has improved support for multi-page forms and login pages containing iframes.

March 9, 2020​

ISM Endpoint Updated with Advanced Diagnostics​
Auto-Login Enhancements​
  • Veracode Dynamic Analysis has streamlined authentication configuration with an enhanced auto-login capability. You should use auto-login to provide a username and password for auto-login, browser-generated logins, and NTLMv2. Auto-login is the default setting. A separate, basic authentication section is available to configure authentication for websites that require two forms of authentication: auto-login and browser-generated authentication. Veracode continues to support Selenium-based login scripts with these changes.
Coverage Improvements​
  • The latest release of Veracode Dynamic Analysis includes new generic injection techniques in the scan engine and flaw publishing process. Veracode can now detect additional vulnerabilities for CWEs 95, 89, 91, and 74. In addition, SQL Injection, OS Command Injection, Remote File Inclusion (RFI), Server-side Request Forgery (SSRF), XML External Entity (XXE), and Cross-site Scripting (XSS) detection can now attack JSON keys and values in POST bodies by default.

February 21, 2020​

New Video - View Dynamic Analysis Results​
  • This video shows you how to view Dynamic Analysis results.

February 14, 2020​

New Video - Create and Run an Unauthenticated Dynamic Analysis​
  • This video shows you how to create, configure, and schedule an unauthenticated Dynamic Analysis.
Row Selection Persistence​
  • When you select the number of rows you want to display in the All Dynamic Analyses table, the selection persists even if you navigate away from that table. Your selection persists until you log out.

January 8, 2020​

New Auto-Publish Feature​

Auto-Publish is now enabled in Veracode Dynamic Analysis to automatically publish some findings, providing quicker results for specific types of vulnerabilities.

  • If every vulnerability found in all URL scans in a Dynamic Analysis meets the criteria for auto-publication, Veracode publishes the findings immediately after the analysis completes.
  • If one or more vulnerabilities require a review by a Veracode scan engineer, then any findings eligible for auto-publication must wait for that review. Veracode publishes all findings together within 24 hours of when the manual review is complete.
Change to Failed Verification Status​

Veracode Dynamic Analysis has updated the status definition that displays when any URL scans fail verification for either a connection or authentication issue.

  • When a single URL scan in an analysis fails verification:
    • The URL scan status is Verification Failed.
    • The Dynamic Analysis status is All Verifications Failed.
  • When an analysis with multiple URL scans has one or more of the URL scans fail verification:
    • The failed URL scan status is Verification Failed.
    • The analysis status is Completed - Partial Results Available.

Application Security Platform

View the list below for highlights of previous releases.

December 7, 2020​

Additional SCA Details Available from the Findings REST API​
  • With the Veracode Findings REST API, you can identify whether Software Composition Analysis findings are from agent-based scans or upload scans and whether they are from a direct or transitive dependency. You can also filter your findings by scan type or dependency type.

November 23, 2020​

Updates to the Findings REST API​

You can now perform these tasks with the Veracode Findings REST API:

  • Retrieve the expiration date of the remediation grace period for findings that violate a security policy.
  • Retrieve findings with comments or mitigations added after a specific date, such as the date of your most recent scan.
Healthcheck REST API​
  • You can use the Veracode Healthcheck REST API to test the availability of Veracode core services.

October 29, 2020​

Changes to OWASP Mobile Policy Rules​

  • Veracode has updated policy rules that include the OWASP Mobile security standard to reflect additional research. OWASP Mobile policy rules now include these CWEs: CWE-77, 78, 80, 252, 287, 319, 345, 404, 415, 416, 601, 614, 676, 693, 757.

  • Applications that contain these flaws may fail OWASP Mobile policy rules as a result of this update. Veracode will apply the update upon rescan of the application.

Improved Notifications for Delayed Scan Results​
  • Veracode has improved communication about delayed scan results. You now receive email notifications that include additional details and links for the affected scan. Veracode has also improved the Veracode Platform to indicate delayed scans that are under investigation.

October 19, 2020​

Applications REST API​
  • You can now view application data and create, update, and delete applications using the Veracode Applications REST API.

September 30, 2020​

Updates to Required Veracode Domains​

September 26, 2020​

Rolling Sandbox Histories​

  • Rolling sandbox histories let you limit sandbox data by restricting the number of retained scans for each sandbox to 15. After more than 15 scans, the Veracode Platform deletes the oldest scan, though the data remains available through Veracode Analytics. If enabled, this feature replaces the previous data limitation method of expiring old sandboxes.

  • To request access to rolling sandbox histories, contact Veracode Technical Support.

Updates to Some XML API Deletion Calls​
  • To improve performance, the deleteuser.do, deleteteam.do, deleteapp.do, and removefiles.do XML API calls now return an HTTP 200 response and a change summary, instead of a list of the items remaining after the deletion.
  • You can now share links to Veracode Analytics dashboards, including Veracode dashboards and dashboards that your organization creates. To access a dashboard link, you must log in to the Veracode Platform and have permission to view the data in the dashboard.
Activity Log Updates​
  • You can now download a report of the full history of application profile activity, scan activity, and sandbox activity. The activity log in the Veracode Platform now displays activity data for the past 90 days.
Technique Removed from TSRV Format for Accepting Risk​
  • Veracode has removed Technique from the TSRV standard when you perform the Accept the Risk mitigation action because none of the techniques are relevant to accepting risk. Specifics, Remaining Risk, and Verification are still required fields.
Updates to CWE Top 25 Policy Rules​
  • The Latest CWE Top 25 policy rule in the Veracode Platform now reflects the 2020 CWE Top 25 standard. Veracode has also updated the 2019 CWE Top 25 policy rule to disallow the children of CWE-94: CWE-91, 95, 98, 185, and 830.

September 17, 2020​

Improved Business Units Tab​
  • On the Administration page in the Veracode Platform, Veracode has improved the usability of the Business Units tab.

September 10, 2020​

New Video - Create and Manage API Users in the Veracode Platform​

August 29, 2020​

All Applications Page Now Available to Mitigation Approver and Delete Scans Roles​
  • You can now access the All Applications page in the Veracode Platform with the Mitigation Approver or Delete Scans roles. From the All Applications page, you can, then, select an application to approve mitigations or delete scans.
CWE-74 Now Disallowed for the OWASP Security Standard​
  • Veracode has reclassified CWE-74 "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" as a high severity finding. CWE-74, which Veracode discovers during Dynamic Analysis, is now included on the disallowed CWE IDs list in the latest version of the OWASP security standard. If your organization is using the OWASP 2017 security standard, you may see more findings violating policy or see your application fail policy as a result of this change.
Support for MITRE CWE List Version 4.1​

  • Veracode now provides reporting based on CWE version 4.1 definitions, which changes the names and descriptions of a few existing CWE categories. The complete list of changes in CWE version 4.1 is available from the MITRE website. This new version does not impact the CWE mappings for the OWASP, CWE Top 25, or CERT security standards.

  • MITRE is updating their CWE list on a more frequent basis, but Veracode remains committed to staying up-to-date with each new version. As MITRE updates their CWE database, you might notice periodic changes in Veracode reports, such as differences between parent-child relationships or mappings.

August 21, 2020​

Findings API Version 2​
  • The Veracode Findings REST API v2 is now available. With this API, you can access information about open and mitigated findings associated with applications and sandboxes. It supports Static Analysis, Dynamic Analysis, Manual Penetration Testing, and Software Composition Analysis scans.

July 28, 2020​

Improved User Activity Report​
  • An improved user activity report is now available to download as a CSV file, providing easier access to information about user actions.

July 7, 2020​

Administrators Can Turn Off Optional Notifications for Their Entire Organization​
  • Administrators in the Veracode Platform can now turn off all optional notifications for all new and existing users in their organization account. Individual users have the option to turn the notifications back on for their own user account.

June 29, 2020​

New Accept the Risk Mitigation Type​
  • Veracode now allows you to resolve a finding by stating that your business is willing to accept the risk associated with that finding. This mitigation type allows you to track and report the risk while continuing to maintain the mitigation and resolution approval process. Veracode updated the mitigationinfo.xsd file to include this mitigation type.

June 27, 2020​

Veracode Policies Now Support 2019 CWE Top 25 Security Standard​
  • Veracode updated the PCI security standard in the Veracode Platform to include the 2019 CWE Top 25 Security Standard, previously called the SANS Top 25 standard. Applications with findings included in the new standard may fail the PCI policy or PCI standard requirement as a result. Veracode applies the update to applications upon rescan.

June 16, 2020​

Veracode Analytics Provides Ignored Issue SCA Data​
  • Veracode Analytics now supports SCA agent-based scan issue data about ignored issues, including details of when a user ignored an issue and the username for the user who ignored the issue.

June 11, 2020​

New Sandbox Attributes Added to Veracode Analytics​
  • Veracode Analytics now provides attributes for tracking sandbox usage. You can view sandbox expiration dates and determine if the Veracode Platform sandboxes are configured for Veracode to automatically recreate them after expiration.
New Dynamic Analysis Dimensions Available in Veracode Analytics​
  • Veracode Analytics now provides the Dynamic Analysis fields Path and Vulnerable Parameter, which allow you to better focus and prioritize your remediation efforts.

June 8, 2020​

SCA Agent Data Available in Veracode Analytics​
  • The Software Composition Analysis (SCA) dashboard is updated in Veracode Analytics to reflect recommended charts for tracking your use of SCA agent-based and upload-and-scan workflows. In addition, Veracode Analytics provides two new explores for SCA agent data: SCA Agent Issues and SCA Agent Scans. These explores enable you to create your own charts and dashboards, providing a better understanding of your open-source risk.

May 28, 2020​

Update to Industry Values in Application Profile​

  • Veracode has updated the values for industries in application profiles to more accurately reflect the market. Because applications include industry values to help inform the Veracode State of Software Security report, this change affects the createapp.do and updateapp.do XML API calls.

  • If you have a script coded with an expected value for the industry field, please update your script to reflect the updated values or use the default value already provided.

May 13, 2020​

Analytics Scan Frequency Requirements Data​
  • Veracode Analytics now provides visibility into scan frequency requirements for an application. These requirements include the frequency mandated by the policy, upcoming scan due dates, and any past due dates.

May 7, 2020​

New Team Admin Role​
  • Veracode has added the new Team Admin user role that an administrator can grant to users. With the Team Admin role, you can create, edit, and delete users within the teams you manage. This new role makes it easier for organizations to manage permissions for a large number of users.
New Mitigation Type​
  • Veracode has added a new mitigation type to allow you to propose mitigations using the mitigation type Mitigated - Referred to Library Maintainer. You can classify findings related to libraries developed by another development team. Another development team may build libraries in-house, but they may not own the application Veracode is scanning.

April 30, 2020​

New Identity REST APIs​
  • The new Identity REST APIs allow you to manage users, teams, and business units. You can also use these REST APIs to create API service accounts and manage API ID/key credentials.
Updated Greenlight Scans Explore Page​
  • Veracode has updated the Analytics page Greenlight Scans Explore to reflect the new terminology of IDE scan (formerly known as Greenlight) and to include pipeline scan data.
Updated Applications List View​
  • The All Applications page in the Veracode Platform now provides customizable columns and improved searching and filtering. Veracode is gradually releasing this feature as part of each Platform release, so it may not be immediately available to you.
New Secure Coding Foundation eLearning Courses​

Veracode eLearning has released a new set of secure coding foundation courses:

  • Secure Coding Foundations - Authentication
  • Secure Coding Foundations - Authorization
  • Secure Coding Foundations - Configuration and Deployment
  • Secure Coding Foundations - Data Protection
  • Secure Coding Foundations - Information and Error Handling
  • Secure Coding Foundations - Trust Boundaries
  • Secure Coding Foundations - Validation and Encoding

These courses cover application security practices and associated vulnerabilities.

eLearning User Interface Enhancements​

Veracode has improved these eLearning windows:

  • Manager window you use to assign learners to a manager
  • Curriculum window you use to assign learners to a curriculum

April 21, 2020​

Updated Applications List View

  • The All Applications page in the Veracode Platform now provides customizable columns and improved searching and filtering.

March 28, 2020​

CWE 4.0 Support​
  • Veracode CWE support is updated to reflect the latest changes from MITRE in the CWE 4.0 release.
Enable Automatic Re-creation of Existing Sandboxes​
  • You can now edit existing sandboxes to enable the setting for automatically re-creating the sandbox when it expires.
Due Date Notifications for eLearning Students​
  • eLearning administrators can now specify when to send email reminders to notify students about the due dates for assigned courses.
New Python and JavaScript eLearning Courses​
  • Veracode has added secure coding courses for Python and JavaScript to eLearning learner levels.

March 19, 2020​

New Grace Period Expiration Date in Analytics​
  • Veracode Analytics now provides the date when a grace period expires. An expired grace period causes the finding to fail the policy associated with the application. Veracode calculates the date based on the First Found or Last Reopened date, whichever is more recent.
Account Lock Does Not Trigger Email to Administrator​
  • To prevent redundant notifications, Veracode no longer sends an email to Administrators in the Veracode Platform when users in their organization are locked out of their accounts. This email is now unnecessary because users can unlock their own accounts.

March 3, 2020​

Improved Developer Sandbox Scanning and Added Expiration Date​

Veracode has made these improvements to developer sandboxes:

  • You can now perform up to ten sandbox scans simultaneously for a single application. Before starting additional scans, you must wait for at least one running scan to complete.
  • The sandbox list in the application profile now shows all sandboxes in the application that have running scans.
  • All sandboxes now have an expiration date. After a sandbox reaches its expiration date, you can no longer perform scans in it. Seven days after the expiration date, the Veracode Platform automatically removes the sandbox. All data about the removed sandbox is available from Veracode Analytics. You can use the re-create option to have the Veracode Platform automatically create a new sandbox with the same name as a previously-removed sandbox.
Applications REST API Adds Policy Compliance Information​
  • Veracode has improved the Applications REST API to include information about the policy compliance of the application.
Executive Summary in Customizable Report PDF Includes Informational Findings​
  • The executive summary in the downloadable PDF of the Customizable Report now shows informational findings. The informational findings provide information that can help you ensure your application meets policy compliance.
Email Notifications for eLearning Curriculum Due Date Changes​
  • eLearning administrators can now send emails to notify students and their managers when the due date for an assigned curriculum changes. They can also send emails to notify managers when a due date on a curriculum has passed and students have not completed the curriculum.

February 21, 2020​

New JavaScript eLearning Courses​

Veracode eLearning has released a new set of secure coding courses for JavaScript:

  • Secure Coding for JavaScript - Authentication & Authorization
  • Secure Coding for JavaScript - Configuration and Deployment
  • Secure Coding for JavaScript - Data Protection
  • Secure Coding for JavaScript - Information and Error Handling
  • Secure Coding for JavaScript - Validation and Encoding

These courses cover application security practices and associated vulnerabilities, including the OWASP Top Ten, and secure coding techniques in JavaScript, including using the AngularJS and ReachJS frameworks.

February 19, 2020​

Updated Look-and-Feel with New Veracode Branding​
  • Veracode has updated the look-and-feel of the Veracode Platform with new branding.

January 28, 2020​

Updates to Sandbox Functionality​

Veracode has implemented these changes to improve the performance of sandbox scans:

  • You can delete a sandbox and all of its scans when you promote it to policy.
  • You may have a maximum number of sandboxes you can create for each application. The default limit is 25.
Automated Emails for eLearning Curriculum Updates​
  • Veracode eLearning administrators can turn on automated email notifications to alert eLearning students and managers when the administrator assigns a curriculum to a student.

January 24, 2020​

New Video - Create a Custom Policy in the Veracode Platform​
  • This video shows you how to create a custom policy in the Veracode Platform.

January 13, 2020​

SCA Findings Dashboard Available in Analytics​
  • Veracode Analytics has a new dashboard that provides Software Composition Analysis (SCA) findings on open vulnerabilities, license risk, issue severities, and library data. Veracode Analytics does not currently display findings from agent-based scans.

January 8, 2020​

New Video - Review Scan Results​
  • This video shows you how to view Veracode scan results in the Veracode Platform.

January 2, 2020​

SCA Findings Available in Veracode Analytics​

  • Veracode Analytics now provides details about Software Composition Analysis (SCA) findings. If you have an SCA subscription, you can view SCA vulnerabilities displayed in the Findings Status & History dashboard and the Resolution and Mitigation Details dashboard.

  • Veracode Analytics does not currently display findings from agent-based scans.

Software Composition Analysis​

View the list below for highlights of previous releases.

December 17, 2020​

Container Scanning for Debian​
  • Veracode Software Composition Analysis now supports agent-based scans of Debian Docker containers. You can scan Debian containers through the command-line interface or as part of your continuous integration pipelines.

October 15, 2020​

Set Default Branch to the Most Recently Scanned Branch or Tag​

  • You can now set your Veracode Software Composition Analysis projects to automatically update their default branch to be the most recently scanned branch or tag. This enhancement enables the use of tags as default branches and reduces the number of issues that display in the Veracode Platform, by default.

  • Existing projects without a default branch selected in their project settings now use the Use Last Scanned option as the default branch.

October 13, 2020​

Vulnerable Method Support for JavaScript​
  • Veracode Software Composition Analysis supports vulnerable method analysis for agent-based scans of JavaScript applications. This feature helps prioritize your remediation actions by identifying first-party code that calls a function in a JavaScript library that makes the library vulnerable.

October 1, 2020​

Container Scanning for Ubuntu​
  • Veracode Software Composition Analysis now supports agent-based scans of Ubuntu Docker containers. You can scan Ubuntu containers through the command-line interface or as part of your continuous integration pipelines.

September 26, 2020​

Grace Periods for SCA Policy Rules​
  • Veracode Software Composition Analysis now allows you to include grace periods for SCA upload scans in your application security policies. You can define a grace period for all scan types, including SCA, or define a grace period that applies specifically to SCA scans.

July 17, 2020​

Default Date Limit Applied to Scan Data in Agent-Based Scan Workspaces​
  • To improve performance and usability, the scan data for your workspaces is now limited to projects scanned in the last 30 days, by default. You can change the time window of exported projects on the workspace page in the Veracode Platform.

July 7, 2020​

Advanced License Risk Management for Agent-Based Scans​
  • Veracode Software Composition Analysis now provides advanced license risk management capabilities for agent-based scans. You can control the acceptable risk from open-source libraries by adding rules based on Veracode license risk ratings or by rejecting specific licenses.

June 17, 2020​

New API Endpoints for Agent Management​
  • The Veracode SCA Agent REST API includes new endpoints for creating and deleting agents. This update enables you to more effectively scale your agent administration and improve productivity with agent-based scans.

May 28, 2020​

Issue Summary for Agent-Based Scans​
  • Veracode Software Composition Analysis now provides a summary table on each agent-based scan workspace and project page that provides a quick view of the state of your open-source issues.

April 29, 2020​

Vulnerability Database Update​

  • The Veracode Vulnerability Database is updated to resolve a discrepancy in severity rating compared to the National Vulnerability Database (NVD) for approximately 200 of over 20,000 total vulnerabilities. Veracode has already contacted all organizations that have applications that fail policy as a result of this update.

  • If your Veracode account manager has not contacted you, you do not need to take any action.

April 6, 2020​

Alpine Linux Support for Agent-Based Scans​
  • Veracode Software Composition Analysis (SCA) now supports the Alpine Linux distribution for agent-based scans.
Organization Rules for Agent-Based Scans​
  • Veracode Software Composition Analysis (SCA) now supports configuring rules for agent-based scans at the organization level. Administrators can apply these rules to all workspaces in an organization to efficiently enforce a common security standard.

April 3, 2020​

New API Endpoint for Auditing Agent-Based Scan Events​
  • The Veracode SCA Agent REST API includes a new endpoint that provides a detailed audit of events for agent-based scans.

March 17, 2020​

License Risk Details for Agent-Based Scans​
  • Veracode Software Composition Analysis (SCA) provides the license risk rating of each open-source license type identified in agent-based scans to help you make informed decisions about acceptable risk.
Gem Support for Containers​
  • Agent-based scans now support the gem package manager for scanning Docker containers.

March 16, 2020​

New Video - Set Up an Agent to Scan with Veracode Software Composition Analysis​

This video shows you how to:

  • Create a workspace
  • Set up an agent
  • Start a scan from your command line
  • View scan results

March 9, 2020​

ISM endpoint 20.3.5​
  • The endpoint installer supports client-side Java and 32-bit Java.
  • The endpoint installer supports proxy gateway-only property.
  • The endpoint supports running diagnostics through a DSE tunnel.
  • The endpoint supports new advanced diagnostics options.
  • Consolidated direct diagnostic options and diagnostics options that run through a DSE tunnel.
  • The ISM service from the Windows installer runs under the less privileged LocalService account instead of LocalSystem.
  • Proxy configuration in the installer no longer requires web access to veracode.com.
  • Resolved issue with property merge in the endpoint installer.
  • Improved endpoint memory management and out of memory protection.

February 13, 2020​

NPM and Pip Support for Containers​
  • Agent-based scans now support the NPM and pip package managers for scanning Docker containers.

January 29, 2020​

Update to Integrated SCA Upload and Scan​
  • If you use Veracode Integrated Software Composition Analysis without a Veracode Static Analysis subscription, you can now perform scans using the upload and scan method.
SCA Results Export​
  • You can now generate and download your latest Software Composition Analysis results from the Export Data page in the Veracode Platform at any time. This report does not include data from agent-based scans.

January 24, 2020​

New Video - Upload and Scan with Veracode Software Composition Analysis​
  • This video shows you how to upload and scan applications with Veracode Software Composition Analysis.

January 15, 2020​

Get Teams List with the SCA Agent REST API​
  • The Veracode SCA Agent REST API for Veracode Agent-Based Scan now supports retrieving a list of the teams in an organization, including filtering by the full or partial team name.
]]> <![CDATA[EASM updates]]> https://docs.veracode.com/updates/r/EASM_updates 2026-09-21T00:00:00.000Z The updates on this page apply to External Attack Surface Management (EASM). Subscribe to the EASM updates RSS feed Feed-icon.png.

September 21, 2026​

Redesigned EASM UI​

Experience EASM's redesigned interface with improved navigation and usability. If needed, you can still use the Legacy UI.

August 5, 2026​

Notifications for scan events​

You can now receive real-time in-app notifications when scans complete, fail, or are cancelled.

June 8, 2026​

Multi-project visibility, scan scheduling and AI-powered intelligence​

Multi-project visibility, scan scheduling, and AI-powered intelligence provide centralized risk management and streamlined scan orchestration, enabling accelerated risk prioritization and enhanced operational efficiency across all projects.

March 24, 2026​

User interface and performance improvements​

Interface refinements and performance optimizations improve usability and overall system performance.

February 9, 2026​

Added Findings view, enhanced prioritization workflows, and improved reports​

The Findings view, improved prioritization workflows, and expanded reporting capabilities turn large volumes of security data into clear, actionable insights. These updates help you prioritize remediation, make faster decisions, and strengthen your overall security posture.

November 19, 2025​

Added Issues capability in EASM​

EASM now includes the Issues capability to streamline remediation efforts and improve focus on cyber hygiene.

September 21, 2025​

EASM enhancements​

This release introduces significant updates across core areas of EASM. Key enhancements include:

  • Dashboard: new Heatmap, World map, and Things widgets with filterable data views and a shortcut to create reports.
  • Navigation: updated icons, refreshed layouts, and reorganized menus for smoother workflows.
  • Business units: create, assign, and manage business units with domain associations.
  • Deep discovery: enhanced work queue, selection toggles, and clearer result indicators.
  • UX and UI: updated side navigation, new table columns, scan progress messages, certificate details, branding updates, and responsive design.
  • Fixes and minor improvements: filters, refresh handling, risk score alignment, and general stability updates.

June 30, 2025​

Export DAST candidates from EASM​

You can now export web applications from EASM directly into DAST Essentials. Marking assets as DAST Candidates creates discovered targets that can be scanned in DAST Essentials.

May 1, 2025​

External Attack Surface Monitoring​

Veracode External Attack Surface Management (EASM) is now available. EASM enables you to scan your organization’s entire digital footprint, assess its cyber hygiene, and measure risk exposure. It helps enhance your cybersecurity posture by identifying and addressing issues before attackers can exploit them.

]]> <![CDATA[Fix updates]]> https://docs.veracode.com/updates/r/Fix_updates 2026-09-08T00:00:00.000Z The updates on this page apply to Veracode Fix. Subscribe to the Fix updates RSS feed Feed-icon.png.

For updates on products that integrate with Veracode Fix, see their respective update pages.

September 8, 2026​

Veracode Fix for SCA Limited Availability release​

Veracode Fix for SCA analyzes vulnerable dependencies from Software Composition Analysis findings, generates remediation patches, and identifies safe upgrade paths. Access this feature through the Veracode CLI by using the veracode fix sca command or through your source control management system.

This is a Limited Availability (LA) release only available to specific Veracode customers.

July 31, 2026​

Improved Veracode Fix suggestions​

This release improves the quality of recommendations for all Fix supported languages.

May 20, 2026​

Improved Veracode Fix suggestions​

This release improves the quality of recommendations for all Fix supported languages.

November 12, 2025​

Improved Veracode Fix suggestions​

This release improves the quality of Fix recommendations for all languages.

September 15, 2025​

Veracode Fix v1.29.3​

This release includes updates to the Veracode Fix API.

August 26, 2025​

Veracode Fix v1.28.5​

This release includes updates to the Veracode Fix API.

August 19, 2025​

Veracode Fix v1.28.1​

This update includes the following improvements:

  • Updates reference patches for CWE-601 in TypeScript and C#.
  • Updates the Veracode Fix API.

July 11, 2025​

Improved Veracode Fix suggestions for CWEs​

Improved fix suggestions for the following CWEs:

  • Java: CWE-117, CWE-113, CWE-80
  • C#: CWE-117, CWE-80, CWE-73
  • JavaScript: CWE-117, CWE-113, CWE-73
  • Python: CWE-73

June 27, 2025​

Support for COBOL and additional CWEs​

Veracode Fix now provides suggested fixes for COBOL. It detects CWE-78, 209, 248, 489, and 252. COBOL support is now available in the Veracode CLI and in IDEs—Visual Studio Code, Visual Studio, and JetBrains.

August 7, 2024​

Support for Ruby and additional CWEs​

Veracode Fix now provides suggested fixes for Ruby. It detects CWE-73, 80, 89, 117, and 601.

April 25, 2024​

Support for Go and additional CWEs​

Veracode Fix now provides suggested fixes for Go. It detects CWE-73, 78, and 117.

March 29, 2024​

Support for Kotlin and Scala​

Veracode Fix now provides suggested fixes for Kotlin and Scala.

February 14, 2024​

Support for Python and PHP​

Veracode Fix now provides suggested fixes for Python and PHP.

Previous updates​

2023 updates​

2023 updates

October 5, 2023​

Support for JavaScript and TypeScript​

Veracode Fix now provides suggested fixes for JavaScript and TypeScript.

Veracode Fix is now available in the European region ​

Veracode Fix is now fully supported in the European region.

]]> <![CDATA[Integration updates]]> https://docs.veracode.com/updates/r/c_all_int 2026-10-09T00:00:00.000Z The updates on this page apply to the Veracode integrations and APIs. Subscribe to the Integration updates RSS feed Feed-icon.png.

Updates that apply to specific Veracode regions show a region icon. Veracode Greenlight is not supported in the European region.

For updates specific to Veracode Fix, such as language and CWE support, see Fix updates. For updates specific to the SCA integrations, see SCA updates.

October 9, 2026​

Java API wrapper v26.10.20.1​

This release changes Git metadata collection so that the Java API wrapper updates the repository URL in the Veracode application profile only when you specify the -repourl parameter.

October 8, 2026​

Veracode Scan for JetBrains v1.8.1​

This release includes the following updates:

  • Adds support for JetBrains IDE versions 2024.2 through 2026.3.
  • Adds dynamic IDE name tracking to identify the JetBrains IDE variant.
  • Resolves issues and includes improvements across scanning, policies, authentication, the user interface, filtering, MSI packaging, and security.

October 7, 2026​

Java API wrapper v26.10.20.0​

This release automatically includes Git repository and commit metadata in Static Analysis scans submitted from a Git repository. The metadata includes the branch, commit, author, repository, and Git provider for supported JAR, WAR, EAR, and ZIP archives.

Azure DevOps Workflow Integration v2.4.5​

This release includes the following updates:

  • Adds the policy parameter to veracode.yml for infrastructure-as-code (IaC) scans.
  • Updates dependencies to remediate high-severity vulnerabilities.

October 6, 2026​

GitLab Workflow Integration v2.1.9​

This release includes the following updates:

  • Adds the predependency_command parameter to veracode.yml to run single-line or multiline commands before Veracode packages the project.
  • Adds the policy parameter to veracode.yml for infrastructure-as-code (IaC) scans.
  • Prevents merge requests from merging when break_build_policy_findings and break_build_on_error are set to true.
  • Optimizes SCA scans in GitLab workflows.

September 30, 2026​

Veracode Azure DevOps Extension v4.0.0​

This update includes the following improvements:

  • Deprecates Veracode Flaw Importer v3 and replaces it with VeracodeFlawImporter v4.
  • Updates Upload and Scan to v4.
  • Applies dependency and security updates and remediates high-severity vulnerabilities.

Upgrade to Azure DevOps Extension v4.0.0:

  • For Azure DevOps Server, upgrade from v3.35.0 to v4.0.0 without uninstalling the previous version.
  • For Azure DevOps (Cloud), the extension updates automatically.
  • For both Azure DevOps Server and Azure DevOps (Cloud), manually migrate the existing pipelines from v3 to v4.

For details, see Azure DevOps Extension.

September 28, 2026​

Veracode Scan for VS Code v1.16.4​

This release includes the following updates:

  • Adds a Mitigated Findings section to the Flaws That Violate Policy view for findings with approved mitigations.
  • Updates the Leave Feedback survey link to use SurveyMonkey.

September 16, 2026​

GitHub Workflow Integration v2.1.7 ​

This release adds the policy parameter to veracode.yml for infrastructure-as-code (IaC) scans.

Veracode Integration for Jira Server v5.0.2​

This update includes the following improvements:

  • Adds support for Jira 11, including the required Java 21 and platform compatibility updates.
  • Updates affected workflows and user interface components to improve compatibility and stability with Jira 11.3.10.

September 15, 2026​

Azure DevOps Workflow Integration v2.4.4​

This release includes the following updates:

  • Adds support for the predependency_command parameter in veracode.yml, which lets you run single-line or multiline commands before Veracode packages the project.
  • Resolves an issue that caused the installation process to fail when creating the central veracode repository in Azure DevOps.

September 8, 2026​

GitHub Workflow Integration now supports Veracode Fix for SCA​

The GitHub Workflow Integration now generates fixes for vulnerable dependencies identified in Software Composition Analysis (SCA) scans. For more information, see GitHub Workflow Integration.

Veracode Fix for SCA is a Limited Availability (LA) release only available to specific Veracode customers.

September 7, 2026​

Veracode Scan for Visual Studio v0.8.2​

This update improves packaging.

August 26, 2026​

Veracode Scan for VS Code v1.16.3​

This release includes the following updates:

  • Adds an option to change the region during OAuth authentication and displays the current or most recently used region. This option appears on the OAuth authentication screen below Authentication.
  • Adds a Current File filter to Static Scan Findings, allowing you to view findings for the file currently open in the editor.
  • Adds an option to filter and group Static Scan Findings by file name, with findings for each file grouped by severity.
  • Updates the Static Findings Filter label to clearly display the applied filters.

August 25, 2026​

GitHub Workflow Integration v2.1.3​

This release includes the following updates:

  • Adds support for custom predependency commands in the Veracode YAML file to prepare projects before scanning.
  • Resolves an issue in which pipeline scans could fail unexpectedly when vulnerabilities are mitigated or build-failure settings are disabled.

August 24, 2026​

Veracode Integration for Jira Cloud v5.0.0​

This release upgrades the integration and its dependencies to improve security, performance, compatibility, and long-term platform support. This release does not include functional changes.

August 19, 2026​

Azure DevOps Workflow Integration v2.4.3​

This release adds support for a custom agent pool name parameter in veracode.yml that lets you specify the agent pool to use for pipeline execution.

August 10, 2026​

Veracode Scan for Visual Studio v0.8.1​

This update includes the following improvements:

  • Resolves an issue that could cause the interface to freeze.
  • Resolves issues with loading indicators to provide accurate status information during transitions.
  • Resolves an issue with the Logout Enable or Disable toggle to ensure that it works as expected.
  • Improves diagnostic logging to help Veracode Support investigate issues.

August 6, 2026​

GitHub Workflow Integration v2.1.2​

This release mitigates an issue in which the GitHub API does not update or reflect the correct check run status. Until GitHub permanently resolves the issue, this update includes a retry mechanism for updating checks, allowing you to merge your pull requests without being blocked.

July 30, 2026​

End of support for Jira 9 in the Veracode Integration for Jira​

On November 30, 2026, Veracode will end support for the Veracode Integration for Jira on Jira Server and Jira Data Center 9.x. To continue using a supported version of the integration, upgrade to Jira 10 or later before this date.

Veracode Integration for Jira Server v4.17.0 and v4.17.1​

These updates improve scheduled flaw import performance by optimizing application lookup operations.

GitHub Workflow Integration v2.1.1​

Updated default runner image

This release includes an updated default runner image scm-packaging-5.0.0 with improved packaging capabilities. The following components have been updated:

  • Alpine v3.24.0
  • Ubuntu v26.04
  • .NET v10
  • PipEnv v2026.6.2
  • libicu v78
  • Node.js v22.22.1
  • Python v3.14.4

New uninstallation workflow

You can now uninstall the Veracode app from your GitHub organizations using a new uninstallation workflow on the Veracode Platform.

July 7, 2026​

Veracode Azure DevOps extension v3.35.0​

This release updates the extension for compatibility with a future Microsoft TFX packaging library upgrade. The Veracode Flaw Importer task, which contains spaces in the task name, is now deprecated and replaced by the VeracodeFlawImporter task. Both tasks are currently supported, but the deprecated task is scheduled for removal in a future release.

June 30, 2026​

GitHub Workflow Integration v2.0.0​

Install and update the integration from the Veracode Platform

You can now install and configure the Veracode GitHub Integration directly from the Veracode Platform, eliminating the manual steps required for GitHub Marketplace installation. You can also update integration credentials from the Veracode Platform.

If you previously installed the integration through the GitHub Marketplace for one or more organizations, you can use the Veracode Platform to install it for additional organizations.

You can update credentials for all organizations from the Veracode Platform, regardless of whether you installed the integration through the platform or the marketplace. You can still install and configure the integration through the GitHub Marketplace.

We also added autopackaging support for Apex, VB6, and Perl.

Configure scan schedules from the Veracode Platform

You can schedule Static Analysis, Software Composition Analysis (SCA), and Infrastructure as Code (IaC) scans for organizations where the Veracode GitHub Integration is installed through the Veracode Platform or the GitHub Marketplace.

June 29, 2026​

Veracode Scan for JetBrains v1.8.0​

This update includes usage analytics to provide insights into plugin adoption, feature usage, and scan activity.

June 24, 2026​

Veracode Scan for VS Code v1.16.1​

This update includes the following improvements:

  • Upgrades the SCA Scan Agent to v3.8.116 to improve dependency processing for some NPM projects, prevent scan timeouts, and improve scan reliability for large or complex dependencies.
  • Resolves an issue where notifications appeared multiple times when searching for a project in the Flaws search field.
  • Improves Auto SCA stability with bug fixes that provide a more reliable scanning experience.

June 18, 2026​

Veracode Static for Eclipse 3.10.0​

This release fixes a scrollbar issue in the TSRV Mitigation dialog to improve navigation and accessibility for long content.

June 15, 2026​

Permissions are downgraded for GitHub Veracode Workflow App​

The GitHub Veracode Workflow App no longer has administration permissions to ensure that the application cannot alter or remove the repositories where it is installed.

June 09, 2026​

GitHub Workflow Integration v1.1.6​

This release updates GitHub Actions to use Node.js 24 instead of the deprecated Node.js 20.

June 05, 2026​

Azure DevOps Workflow Integration v2.4.2 euro-icon.png ​

This release resolves an issue where pipelines are not created for certain projects in ADO workflows. It also resolves a bug that causes policy scans to fail even after findings are marked as mitigated.

May 27, 2026​

Veracode Scan for Visual Studio v0.8.0​

This update includes the following improvements:

  • Adds usage analytics to provide insights into plugin adoption, feature usage, and scan activity.
  • Adds a Scan Scope setting that lets you scan the full project directory or only the active solution for faster, more focused results.
  • Improves MSBuild detection to package .NET Framework applications more reliably.

April 30, 2026​

Veracode Integration for Jira Cloud v4.23.0​

This update improves Jira Cloud component synchronization by retrieving all project components across paginated results.

April 23, 2026​

Azure DevOps Workflow Integration v2.3.10​

If you specify a value for analysis_branch in veracode.yml, scheduled scans now run for that analysis branch instead of the default branch.

April 22, 2026​

Veracode Scan for JetBrains v1.6.3​

This update includes the following improvements:

  • Updates the list of programming languages and file extensions supported by Veracode Fix.
  • Improves overall IDE performance.

April 21, 2026​

Veracode Scan for VS Code v1.16.0​

This update includes usage analytics to provide insights into plugin adoption, feature usage, and scan activity.

April 15, 2026​

Veracode Integration for Jira Cloud v4.22.0​

This update includes the following improvements:

  • Fixes conflicts that occur when one scan type is in progress while another scan type completes and publishes results.
  • Improves the reliability of application retrieval APIs by adding retry logic and upgrading the Java wrapper. This change also addresses multiple critical and high‑severity security vulnerabilities.
  • Prevents unexpected sandbox closures caused by null values in a map. Sandboxes filtered by modified date are no longer incorrectly treated as deleted.

GitLab Workflow Integration v2.1.7​

This release includes the following improvements:

  • Resolves issues that occurred when SCA scans were done on Python projects.
  • Disallows duplicate scans being triggered when merge requests are merged with delete_source_branch selected.

April 14, 2026​

Veracode Scan for Visual Studio v0.7.3​

This release updates the list of programming languages and file extensions supported by Veracode Fix.

April 13, 2026​

Azure DevOps Workflow Integration v2.3.9​

You can now schedule scans for every organization in which the Azure DevOps Workflow Integration is installed. This feature is based on the configurations specified in the veracode.yml file. For more details, see Schedule scans in Azure DevOps.

March 23, 2026​

Veracode Scan for VS Code v1.15.3​

This release updates the list of programming languages and file extensions supported by Veracode Fix.

March 18, 2026​

Java API Wrapper v26.3.19.0​

This release includes the following improvements:

  • Adds page size support to the Platform Applications API (/appsec/v1/applications) to improve efficiency when retrieving large application lists.
  • Introduces support for the Veracode Platform paginated Sandbox REST API, which enables retrieval of sandbox lists using pagination.

March 12, 2026​

Veracode Scan for Visual Studio v0.7.2​

This update includes the following improvements:

  • Adds support for Visual Studio 2026.
  • Fix recommendations provide a single best option instead of multiple options in a dropdown.

March 09, 2026​

Veracode Scan for JetBrains v1.6.2​

This release resolves an issue that caused the plugin to stop functioning when the project path contained spaces. The plugin now loads correctly and scans projects with spaces in their directory paths.

March 05, 2026​

Veracode Azure DevOps extension v3.34.0​

This update includes the following improvements:

  • Improves exception handling to better manage outage scenarios and enhance system resilience.
  • Upgrades the Java Wrapper to version 26.2.18.0.

Veracode Integration for Jira Server v4.16.0 and v4.16.1​

This update includes the following improvements:

  • Adds automatic retry handling for transient platform or network interruptions on safe API calls to improve reliability.
  • Increases the read timeout for API calls to the Veracode Platform.

February 24, 2026​

Veracode Scan for VS Code v1.15.2​

This update includes the following improvements:

  • Fix recommendations provide one best option instead of a multi‑option dropdown.
  • Veracode Fix includes usability improvements for .NET projects.
  • Uses the updated SCA service URLs instead of the legacy SourceClear URL.

February 16, 2026​

Azure DevOps Workflow Integration v2.3.6​

This release provides the debug configuration option in the veracode.yml file for debugging and troubleshooting.

February 10, 2026​

Java API Wrapper v26.2.18.0​

This release includes the following improvements:

  • Implements a configurable retry mechanism for the Veracode Platform Applications API (appsec/v1/applications) to improve handling of transient failures, timeouts, and intermittent network issues.
  • Adds support for the Veracode Platform Findings REST API to access open and mitigated application findings.

February 5, 2026​

GitHub Workflow Integration v1.0.6​

This release provides the debug configuration option in the veracode.yml file for debugging and troubleshooting.

January 29, 2026​

GitLab Workflow Integration v2.1.4​

This release includes the following improvements:

  • Provides the debug configuration option in the veracode.yml file for debugging and troubleshooting.
  • Resolves issues related to the manual uninstallation of the GitLab Workflow Integration.

January 22, 2026​

Veracode Scan for JetBrains v1.6.1​

This update includes the following improvements:

  • Improves telemetry logging through expanded event analytics.
  • Updates the SCA agent to the latest version.
  • Resolves an issue that causes OAuth logout failures when multiple IDE windows are open.

January 21, 2026​

Veracode Scan for Eclipse v1.4.1​

This update includes the following improvements:

  • Improves telemetry logging through expanded event analytics.
  • Updates the SCA agent to the latest version.
  • Resolves an issue that causes OAuth logout failures when multiple IDE windows are open.

January 16, 2026​

Azure DevOps Workflow Integration v2.3.3​

This update ensures that when custom policies are applied in the Veracode Platform with the Build Action: error configuration for an SCA agent-based scan, the SCA scan fails when vulnerabilities are found.

January 15, 2026​

Veracode Integration for Jira Cloud v4.21.0​

This update includes the following improvements:

  • Refines retry behavior to respect Atlassian’s recommended backoff timing.
  • Strengthens HTTP connection management and enforces request timeouts.
  • Expands request tracing and logging to simplify diagnosing throttling and network issues.

January 14, 2026​

Veracode Scan for Visual Studio v0.7.1​

This update includes the following improvements:

  • Introduces a structured event model for Veracode scan processes in Visual Studio. This model captures additional IDE, project, and scan metadata to support more reliable analytics.
  • Improves telemetry logging by refining event data collection, providing better visibility into IDE activity and scan performance.

December 18, 2025​

Veracode Scan for VS Code v1.15.1​

This update includes the following improvements:

  • Adds a structured IDE scan process that sends detailed telemetry events.
  • Collects additional IDE, project, and scan metadata to improve analytics reliability.

December 11, 2025​

Veracode Scan for Visual Studio v0.7.0​

This update includes the following improvements:

December 10, 2025​

Azure DevOps Workflow Integration v2.3.0​

This update ensures that any findings marked as mitigated on the platform are excluded from pipeline scan results.

November 25, 2025​

GitHub Workflow Integration v1.0.3​

This update adds support for Windows-based runners when using the GitHub workflow integration.

November 18, 2025​

Java API Wrapper v25.11.17.0​

This update removes INI credentials loader dependency to address a critical security vulnerability and improve case-insensitive credential loading.

Veracode Scan for JetBrains v1.6.0​

This update includes the following improvements:

October 29, 2025​

GitHub Workflow Integration v1.0.2​

This update resolves an issue that prevented scans from being triggered when the actions section was added to the veracode.yml file.

October 24, 2025​

Veracode TeamCity Plugin v3.0.0​

This update adds support for TeamCity Cloud.

October 23, 2025​

Veracode Azure DevOps extension v3.33.0​

This update includes the following improvements:

  • Adds support for Node.js version 20.
  • Improves the Azure DevOps flaw importer to increase the accuracy of imported flaw data.
  • Reduces manual effort by automatically updating flaw statuses and severities.
  • Enables automatic closure of work items for remediated SCA vulnerabilities.
  • Updates severity tags for flaws imported into Azure DevOps.

Important note for upgrading to Azure DevOps extension v3.33.0​

This release includes automated tagging for SCA work items, which enables automatic closure when findings are remediated.

First run after upgrade

  • Tags and tracks work items for active SCA findings.
  • Does not tag work items for previously remediated findings because the platform no longer reports them.
  • Requires manually closing untagged work items.

Subsequent runs

  • Tags all SCA work items.
  • Automatically closes work items when findings are remediated.

Additional details

  • Updates the Severity tag and Severity field only when the value changes.
  • For Agile projects, updates apply only to the Bug work item type because other work item types do not include the Severity field.
  • For custom templates, add the Severity field to the work item for updates to apply.

Recommended action:

After the first flaw import run using v3.33.0, review and manually close any SCA work items that were remediated before the upgrade.

October 14, 2025​

Veracode Integration for Jira Cloud v4.20.0​

This update includes the following improvements:

  • Improves performance by replacing the legacy XML API with the paginated and consistent REST API.
  • Enhances stability by handling null values in custom fields to prevent job failures.

October 09, 2025​

Veracode Scan for Visual Studio v0.6.0​

This update adds support for OAuth-based authentication in the extension. You can now authenticate securely with Veracode from your IDE using Single Sign-On (SSO) and OAuth.

October 6, 2025​

GitHub Workflow Integration v0.2.24 ​

This release resolves an issue that caused Static and SCA scans to fail due to GitHub Actions template errors.

September 25, 2025​

Veracode Integration for Jira Server v4.14.0​

This update includes the following improvements:

  • Adds support for sending email notifications when an import fails, using your Jira SMTP server configuration.
  • Resolves an issue that caused unexpected sandbox closures due to a null value in the map.
  • Fixes a bug where sandboxes filtered by modified date were incorrectly marked as deleted, resulting in unintended closures.
  • Improves handling of null values during case matching to prevent failures when creating issues.
  • Addresses three high-severity security vulnerabilities.

Veracode Scan for VS Code v1.15.0​

This update adds support for OAuth-based authentication in the extension. You can authenticate securely with Veracode from your IDE using single sign-on (SSO) and OAuth.

September 22, 2025​

GitHub Workflow Integration v0.2.23​

This update includes the following improvements:

  • Mitigated findings do not block new pipeline scans.
  • When a new policy or sandbox scan is triggered on a branch that is already running these scans, the earlier scans are deleted.
  • Pipeline scans display the correct check run status in GitHub.

September 11, 2025​

GitHub Workflow Integration v0.2.22​

This release resolves an issue where IaC and SCA scans could hang.

September 8, 2025​

Azure DevOps Workflow Integration v2.2.5​

This update resolves an issue in Azure DevOps where Veracode pipelines failed when branch policies triggered duplicate events.

September 05, 2025​

New learning path for Veracode Scan for JetBrains​

Learn how to set up and use Veracode Scan for JetBrains to scan and secure your projects. See the learning path Scan and fix in your IDE.

September 03, 2025​

Veracode Scan for Eclipse v1.4.0​

This update adds support for OAuth-based authentication in the plugin. You can now authenticate securely with Veracode from your IDE using Single Sign-On (SSO) and OAuth.

Veracode TeamCity Plugin v3.0.0​

This update upgrades the Java Wrapper to version 24.10.15.0 for the TeamCity plugin.

September 02, 2025​

Veracode Integration for Jira Cloud v4.19.0​

This update includes the following improvements:

  • Replaces the deprecated Atlassian search API with the JQL search API.
  • Resolves the high-severity vulnerability in Apache Commons.

August 25, 2025​

Veracode Azure DevOps Extension v3.32.0​

This update includes the following improvements:

  • Ensures builds fail when credentials are missing, invalid, or incorrect, regardless of the failBuildIfUploadAndScanBuildStepFails parameter.
  • Updates extension logos to reflect Veracode rebranding.
  • Upgrades the Java wrapper to version 24.10.15.0.

August 20, 2025​

Azure DevOps Workflow Integration v2.2.4 ​

This update resolves the issue of policy and sandbox scans getting held at the module selection step in the Commercial region and European region.

August 12, 2025​

GitLab Workflow Integration v2.0.3​

This release resolves bugs related to visibility of groups, and improves debug logs for troubleshooting.

August 4, 2025​

Java API Wrapper v25.8.16.0​

This update resolves a high-risk vulnerability in the ini4j library (version 0.5.4).

July 29, 2025​

Veracode Static for Visual Studio v1.14.0​

This update includes the following improvements:

  • Fixes medium-severity vulnerabilities.
  • Improves visuals to reflect the rebranding.

July 23, 2025​

Veracode Scan for JetBrains v1.5.2​

This update improves logging.

July 17, 2025​

Veracode Scan for VS Code v1.14.3​

This update improves logging for SCA scans.

July 11, 2025​

Veracode Scan for JetBrains v1.5.1​

This update includes the following improvements:

  • Fixes are now applied successfully even when the user's root folder path contains spaces.
  • The getFixes function is no longer called if a fix is unavailable for a flaw.
  • Resolved an issue where the scan status was displayed incorrectly for multi-module projects.

July 09, 2025​

MSBuild support for Azure DevOps Workflow Integration v2.2.2 ​

This update includes bug fixes and support for .NET projects that require MSBuild for the Azure DevOps Workflow Integration in the Commercial region and European region.

July 02, 2025​

New learning path for Veracode Scan for Eclipse​

Learn how to set up and use Veracode Scan for Eclipse to scan and secure your projects. See the learning path Scan and fix in your IDE.

July 01, 2025​

Veracode Integration for Jira Server v4.13.0​

This update includes security enhancements and bug fixes.

June 30, 2025​

Veracode Scan for Visual Studio v0.5.0​

This update reduces the number of JavaScript artifacts generated when your project contains files with the following extensions:

  • .json
  • .map
  • .yaml
  • .yml
  • .lock
  • .css

June 24, 2025​

Veracode Scan for JetBrains v1.5.0​

Added support for OAuth-based authentication in the plugin. You can now authenticate securely with Veracode from your IDE using Single Sign-On (SSO) and OAuth.

June 18, 2025​

Veracode Scan for Visual Studio v0.4.9​

This update achieves feature parity with the Veracode Scan extension for Visual Studio 2019, providing a consistent scanning experience across supported Visual Studio versions.

June 17, 2025​

Veracode Scan for VS Code v1.14.1​

This update includes the following improvements:

  • Files in node_modules are now excluded from scan searches
  • Added error logging for SCA agent downloads
  • Custom error messages are now shown when no supported package manager or build system is detected during SCA agent scans
  • You can now search application profiles directly within the IDE
  • Paging is now supported to ensure all flaws are fetched during scans

June 10, 2025​

Veracode Jenkins Plugin 25.6.25.0​

This update includes security fixes.

June 09, 2025​

Veracode Scan for JetBrains v1.4.9​

This update includes the following improvements:

  • Enhanced Veracode Fix support in the IDE
  • More accurate flaw-to-source mapping

May 29, 2025​

Veracode Scan for VS Code v1.14.0​

This update includes the following improvements:

Veracode Integration for Jira Server v4.12.0​

This update includes the following improvements:

  • Improved logging to provide more accurate status updates during import operations, making troubleshooting easier.
  • Enhanced performance for faster and more reliable operation.
  • Fixed Software Composition Analysis (SCA) vulnerabilities to strengthen security.

May 28, 2025​

Veracode Scan for Visual Studio 2022 v0.4.8​

This update includes the following improvements:

  • Fixed an issue that prevented the Veracode Fix indicator from displaying for static flaws with available file references
  • Improved logging capabilities
  • Signed the extension for enhanced security and trust

May 20, 2025​

Windows Runner support for Azure DevOps Workflow Integration v2.2.1 ​

This update provides Windows Runner support for the Azure DevOps Workflow Integration in the Commercial region and European region.

May 9, 2025​

GitLab Workflow Integration​

Veracode has released the GitLab Workflow Integration that allows you to scan your GitLab repositories with Static Analysis, Software Composition Analysis (SCA) and Infrastructure as Code (IaC).

GitLab Workflow Integration has the following capabilities:

  • Automates scans for thousands of repositories from a location.
  • Allows Static, SCA, and IaC scans in a single workflow.
  • Eliminates the need to configure workflows for individual repositories.
  • Supports autopackaging for Java, .NET, JavaScript, and Python repositories.

To get access to GitLab Workflow Integration, contact Veracode Technical Support.

This integration is currently available only for GitLab.com and is not compatible with self-hosted GitLab instances. For installation and usage instructions, view the Veracode documentation.

May 08, 2025​

Veracode Scan for Eclipse v1.3.5​

This update includes the following improvements:

  • Skip the vulnerable method analysis during scans in your IDE.
  • The SCA agent now downloads from Sca-downloads.veracode.com instead of Download.sourceclear.com.
  • Veracode Fix now suggests fixes for flaws in COBOL projects.
  • Veracode Fix now generates suggestions for flaws identified in JSP files.

April 28, 2025​

Veracode Static for Visual Studio v1.13.0​

This update includes the following improvements:

  • Updated the interface to display the new Veracode logo.
  • Fixed issues related to SCA vulnerabilities.

April 24, 2025​

Azure DevOps Workflow Integration v2.1.0 ​

This update makes the revamped Azure DevOps Workflow Integration available in the European region.

April 21, 2025​

Veracode Scan for JetBrains v1.4.8​

This update includes the following improvements:

  • Added a null check to improve reliability during the module selection process.
  • Added an option to skip vulnerable method analysis during SCA scans.

April 3, 2025​

Azure DevOps Workflow Integration revamp v2.0.0​

The revised and upgraded Azure DevOps Workflow Integration has the following capabilities:

  • Automates scans for thousands of repositories from a location.
  • Allows Static, SCA, and infrastructure as code (IaC) scans in a single workflow.
  • Eliminates the need to configure workflows for individual repositories.
  • Supports autopackaging for Java, .NET, JavaScript, Python, Go, Kotlin, and React Native repositories.

To get access to the integration, contact Veracode Technical Support.

For information on installing and scanning with the integration, view the Veracode documentation.

March 24, 2025​

Veracode Static for IntelliJ v3.7.1​

This version adds the new Veracode logo to the interface.

March 18, 2025​

Veracode Scan for Visual Studio 2022 v0.4.7​

This update includes the following improvements:

  • Increased the timeout duration for receiving Veracode Fix suggestions.
  • .NET project solution files now support Veracode Fix when Git references are missing.

March 17, 2025​

Veracode Scan for Eclipse v1.3.2​

This update includes the following improvements:

  • Veracode Fix now suggests fixes for flaws in C++ projects.
  • Enhanced Veracode Fix suggestion support for Go projects.
  • Improved logic for matching flaws with code in the editor.
  • Veracode Analytics in the Veracode Platform now tracks Veracode Fix usage from scans in the plugin.
  • Veracode Fix now reports fixes for flaws in .tsx and .jsx files (JavaScript file extensions).
  • Removed support for scanning Perl artifacts because they are not supported by the Veracode Pipeline Scan.

Veracode Jenkins Plugin 25.3.24.0​

This update adds optional Veracode Jenkins Plugin script parameters for the Upload and Scan action in the plugin.

March 04, 2025​

Veracode Scan for VS Code v1.13.5​

This update includes the following improvements:

  • Veracode Fix now suggests fixes for flaws in C++ projects.
  • Enhanced Veracode Fix suggestion support for Go projects.
  • Improved logic for matching flaws with code in the editor.
  • Veracode Analytics in the Veracode Platform now tracks Veracode Fix usage from scans in the extension.

February 27, 2025​

Veracode Scan for JetBrains v1.4.7​

This update includes the following improvements:

  • Veracode Fix now suggests fixes for flaws in C++ projects.
  • Enhanced Veracode Fix suggestion support for Go projects.
  • Exclude non-project files from scanning within the same IDE session.
  • Improved logic for matching flaws with code in the editor.
  • Veracode Analytics in the Veracode Platform now tracks Veracode Fix usage from scans in the plugin.

Veracode Scan for Visual Studio 2022 v0.4.4​

This update includes the following improvements:

  • Veracode Fix now suggests fixes for flaws in C++ projects.
  • Enhanced Veracode Fix suggestion support for Go projects.
  • Improved logic for matching flaws with code in the editor.
  • Veracode Analytics in the Veracode Platform now tracks Veracode Fix usage from scans in the extension.

February 24, 2025​

C# API wrapper v25.2.10.2​

This update includes the following improvements:

  • Now supports updating a Git repository URL for an application profile in the C# API wrapper.
  • Added the failbuild parameter, which fails the build if an artifact of the packaged application fails to upload.
  • Security fixes related to cryptographic issues.
  • Replaced deprecated XML APIs with REST equivalents in C# wrappers.

February 18, 2025​

Veracode Static for IntelliJ v3.7.0​

This update adds support for the new interface introduced in IntelliJ IDEA 2022.3.

February 06, 2025​

Veracode Scan for JetBrains v1.4.6​

This update improves the interface to correctly display the Veracode logo.

Veracode Scan for Visual Studio 2022 v0.4.3​

This update improves the interface to correctly display the Veracode logo.

January 31, 2025​

Veracode Scan IDE integrations rebrand​

Veracode has rebranded the following IDE extensions and plugins:

  • Veracode Scan for VS Code v1.13.4
  • Veracode Scan for JetBrains v1.4.5
  • Veracode Scan for Visual Studio 2022 v0.4.2
  • Veracode Scan for Eclipse v1.3.1

January 21, 2025​

Veracode Scan for JetBrains v1.4.4​

This update adds support for selection from multiple modules.

January 16, 2025​

Veracode Scan for Visual Studio v0.4.1​

This update includes the following improvements:

  • Usability improvements related to running scans and applying suggested fixes.
  • Automatic detection of msbuild ensures that the autopackager reliably packages .NET Framework applications.

January 15, 2025​

Veracode Integration for Jira Server v4.11.0​

This update adds support for Jira version 10.

January 10, 2025​

New learning path for Veracode Scan for VS Code​

To learn how to set up and use Veracode Scan for VS Code to scan and secure your projects, see the new learning path Scan and fix in your IDE.

January 09, 2025​

Veracode Scan for VS Code v1.13.3​

This update improves the SCA Features.Policy setting for User settings. When you select a policy, the selected policy now persists across all instances (windows) of VS Code.

December 19, 2024​

Veracode Workflow App v0.2.16 for GitHub​

This update includes the following improvements:

  • Fixes GitHub issue creation and code scanning alerts.
  • Supports scanning of multiple artifacts in Veracode Pipeline Scan.

December 18, 2024​

Veracode Scan for VS Code v1.13.1​

This update includes the following improvements:

  • Adds auto SCA scanning. Turn on this option to automatically scan all open-source libraries when you open a project or when the libraries change.
  • After you run an SCA scan, the extension now highlights vulnerable libraries in the package manager file for projects that use Maven, npm, or Yarn.

December 13, 2024​

Veracode TeamCity Plugin v2.8.0​

This update includes the following improvements:

  • Added the Optional Argument field. You can now enter optional parameters for Optional Argument in the Upload and Scan task.
  • Minor security improvements.

December 12, 2024​

Veracode Workflow App v0.2.15 for GitHub​

This update includes the following improvements:

  • Fixes Pipeline Scan errors caused by an application profile override or an invalid profile.
  • Fixes issues due to the workflow app including helper files as build artifacts.

Veracode Scan for VS Code v1.12.0​

This update adds an option to skip vulnerable method analysis during SCA scans. When turned on, this option can reduce SCA scan times, but the scans will not detect vulnerable methods in open source libraries.

December 10, 2024​

Veracode Scan for Visual Studio v0.4.0​

This update adds proxy support. You can now sign in to Veracode through a proxy server.

November 28, 2024​

Azure DevOps Workflow Integration v1.3.0 ​

This update makes Azure DevOps Workflow Integration available in the European region.

November 26, 2024​

Veracode Fix Action for GitHub v1.0.1​

This update includes the following improvements:

  • Additional CWE support for single fix and batch fix.
  • Removed restriction of using app as the root folder name in the user codebase.

November 25, 2024​

Veracode Scan for VS Code v1.11.7​

This update improves the suggested fixes from Veracode Fix.

November 20, 2024​

Veracode Scan for Eclipse v1.3.0​

This update adds proxy support. You can now sign in to Veracode through a proxy server.

November 18, 2024​

Veracode Scan for Visual Studio v0.3.2​

This update includes minor performance improvements.

November 14, 2024​

Veracode Scan for VS Code v1.11.6​

This update includes the following improvements:

  • The autopackager has improved support for Go.
  • Improved suggested fixes from Veracode Fix.

November 13, 2024​

Veracode Azure DevOps Extension v3.29.0​

This update includes minor security improvements.

October 25, 2024​

Veracode Scan for JetBrains v1.4.3​

This update includes minor usability improvements.

Veracode Scan for Visual Studio v0.3.1​

This update includes minor performance improvements.

Veracode Scan for VS Code v1.11.5​

This update includes minor performance improvements.

October 24, 2024​

Veracode Scan for Eclipse v1.2.1​

This update includes usability improvements.

October 15, 2024​

Veracode Scan for Visual Studio v0.3.0​

This update adds Software Composition Analysis (SCA) scans to Veracode Scan for Visual Studio. You can now find and fix vulnerabilities in open-source libraries, and review the risk level of the library licenses in your projects.

Veracode Integration for Jira Server v4.10.1​

This update fixes an issue where non-admin users are not able to select the Veracode link in tickets on Jira 9.12 or later.

Veracode Integration for Jira Server v4.10.0​

This update fixes an issue where non-admin users are not able to select the Veracode link in tickets on Jira 9.12 or earlier.

October 10, 2024​

Veracode Fix Action for Github 1.0.0​

This update adds Veracode Fix as a GitHub Action. You can use this GitHub Action to review and apply suggested code fixes to flaws in your GitHub project before merging your commits to the main branch.

October 08, 2024​

Java API wrapper 24.10.15.0​

This update adds the repourl parameter. This parameter updates the Git repo URL for the associated application profile.

September 30, 2024​

Veracode Scan for Eclipse 1.2.0​

This update adds Veracode Software Composition Analysis (SCA) scanning to Veracode Scan for Eclipse.

September 26, 2024​

Veracode Scan for Eclipse v1.1.0​

This update adds Veracode Fix to Veracode Scan for Eclipse. To fix flaws in seconds from within your IDE, you can now apply AI-generated fixes directly to flaws. The plugin name has changed from Veracode SAST for Eclipse IDE to Veracode Scan for Eclipse.

Veracode Scan for Visual Studio v0.2.0​

This update adds Veracode Fix to Veracode Scan for Visual Studio. To fix flaws in seconds from within your IDE, you can now apply AI-generated fixes directly to flaws.

September 24, 2024​

Introducing Veracode Scan for Visual Studio v0.1.0​

Veracode Scan for Visual Studio is an extension that integrates Static Application Security Testing (SAST) with Visual Studio 2019 and 2022. From within your IDE you can:

  • Use autopackaging to have the plugin automatically package your code into a supported artifact for Static Analysis. Or, provide an artifact you packaged manually.
  • Scan your projects to find security flaws in your code.
  • Use the detailed scan results to learn about the flaws, prioritize which flaws to resolve first, and use the provided remediation guidance to fix the flaws.

September 17, 2024​

Veracode Integration for Azure DevOps v3.28.0​

This update includes minor security improvements.

September 16, 2024​

Veracode Integration for Jira Cloud v4.17.0​

This update includes minor performance improvements.

September 12, 2024​

Veracode Workflow App 0.2.13 for GitHub​

This update adds new user configurations to autopackaging that allow you to use your own runner, image, and dependencies for building your projects. The new configurations include:

  • actions:ruby:version: Ruby version required in the project.
  • actions:ruby:bundle: specific bundler required for the gem installation in a Ruby project.
  • actions:{scan type}:build:runs_on: runner for building your project.
  • actions:{scan type}:build:packager_image: a public docker image to use for building your project.
  • actions:{scan type}:build:predependency_command: any additional commands required by the project.

For more details, see the complete list of veracode.yml configurations.

To update your app to reflect these changes, you must import the app repository.

View GitHub workflow data in the Veracode Platform ​

You can now connect your GitHub organizations to your Veracode account in the Veracode Platform in the Commercial region. This feature allows you to review GitHub workflow status and scan activity for all GitHub organizations in which you have installed the Veracode Workflow App.

This feature is not required and does not impact the existing functionality of the Veracode Workflow App.

September 9, 2024​

Introducing Veracode SAST for Eclipse IDE v1.0.0​

Veracode SAST for Eclipse IDE is a plugin that integrates Static Application Security Testing (SAST) with the Eclipse IDE. From within your IDE you can:

  • Use autopackaging to have the plugin automatically package your code into a supported artifact for Static Analysis. Or, provide an artifact you packaged manually.
  • Scan your projects to find security flaws in your code.
  • Use the detailed scan results to learn about the flaws, prioritize which flaws to resolve first, and use the provided remediation guidance to fix the flaws.

September 6, 2024​

Azure DevOps Workflow Integration ​

Veracode has released the Azure DevOps Workflow Integration that allows you to scan your Azure Devops repositories with Static Analysis and Software Composition Analysis (SCA) in the Commercial region. The integration uses template workflows in a centralized location that you can apply to all repositories across your organization.

The functionality of the integration includes:

  • Automated scans of up to thousands of repositories from one location
  • Static, SCA, and infrastructure as code (IaC) scans start on developer activity from a single workflow
  • Automated scanning does not require developers to configure workflows for individual repositories
  • Autopackaging support for Java, .NET, JavaScript, Python, Go, Kotlin, and React Native repositories.

To get access to the integration, contact Veracode Technical Support.

For information on installing and scanning with the integration, view the Veracode documentation.

September 3, 2024​

Veracode Integration for Jira Server 4.9.1​

This update adds security improvements.

August 29, 2024​

Veracode Scan for VS Code 1.11.2​

This update improves Veracode Fix to only provide suggested fixes for flaws with supported CWE IDs.

August 28, 2024​

Veracode Scan for VS Code 1.11.1​

This update improves the data path step links on the Remediation Guidance tab.

August 16, 2024​

Veracode Scan for JetBrains 1.3.1​

This update includes the following improvements:

  • Veracode Fix only provides suggested fixes for flaws with supported CWE IDs.
  • To use autopackaging in Rider on macOS, you no longer need to open the IDE from a command prompt.

July 31, 2024​

Veracode Integration for Jira Server 4.8.1​

This update adds support for Jira Server and Jira Data Center v9.17.1.

Veracode Scan for VS Code 1.11.0​

This update improves the integrated autopackager.

July 24, 2024​

Veracode Scan for VS Code 1.10.0​

This update includes the following improvements:

  • You can now cancel scans.
  • Improved the recommended fixes for vulnerabilities in your libraries.

July 23, 2024​

Veracode Workflow App 0.2.7 for GitHub​

This update adds autopackaging support for JavaScript, Python, Go, Scala, Kotlin, React Native, and Android repositories.

To update your app to reflect these changes, you must import the app repository.

July 18, 2024​

Veracode Scan for JetBrains 1.2.0​

This update includes the following improvements:

  • You can now sign in to Veracode through a proxy server.
  • All debug logs are now under the .veracode folder.
  • The Scan Project button is now turned on after you install and set up the extension.
  • Vulnerable libraries are now sorted by usage.
  • Panels are now cleared after you start a new scan.
  • Minor performance improvements.

July 10, 2024​

Java API Wrapper 24.7.14.0​

This update adds the failbuild parameter. You use this parameter to fail the build if any artifacts of your packaged applications fail to upload.

July 9, 2024​

Veracode Integration for Jira Cloud 4.15.0​

This update includes the following improvements:

  • The Monitoring and Troubleshooting page now successfully displays remarks if an import fails.
  • Projects with more than 50 components now import successfully.

June 28, 2024​

Veracode Workflow App 0.2.3 for GitHub​

This update includes the following improvements:

  • Autopackager support for .NET repositories.
  • The names of GitHub check runs for Veracode Static Analysis now indicate whether they are pipeline scans or policy scans.
  • The GitHub check run summary pages now display the Veracode Platform URL. You can review results regardless of the check run status. Previously, the URL only appeared after the check run succeeded.

If you have not previously granted the app permissions to your GitHub repository, you might receive a notification requesting those permissions when you update your app.

To update your app to reflect these changes, you must import the app repository.

June 24, 2024​

Veracode Scan for JetBrains 1.1.0​

This update includes the following improvements:

  • Adds Veracode Fix to Veracode Scan for JetBrains. To fix flaws in seconds from within your IDE, you can now apply AI-generated fixes directly to flaws.
  • Adds support for the JetBrains Rider IDE.

June 6, 2024​

Veracode Workflow App 0.2.2 for GitHub​

This update includes the following improvements:

  • Upgraded GitHub Actions artifacts to version 4.
  • Autopackaging of Java repositories that do not contain build files in the root directory.
  • Improved memory handling.

To update your app to reflect these changes, you must import the app repository.

Veracode for JetBrains 1.0.0​

This update includes the following improvements:

  • You can now run Static Analysis (SAST) scans to find flaws in your source code. Before scanning, the plugin autopackages your code according to Veracode packaging requirements.
  • Use the filtering options to focus on the static findings that are most important to your organization.
  • Use the provided remediation guidance to fix static findings or use the ignore option to ignore findings you won't fix.

May 30, 2024​

Veracode Scan for VS Code 1.9.2​

This update includes the following improvements:

  • The proxy support option is now generally available.
  • The timeout limit for Static Analysis scans has increased to 60 minutes.

Veracode Azure DevOps Extension 3.27.2​

This update adds support for Node 10 and Node 16.

May 21, 2024​

Veracode Scan for VS Code 1.9.1 - Pre-release​

This update improves the proxy support option. Before you install this update, on the Visual Studio Code Marketplace, select Switch to Pre-Release Version.

May 16, 2024​

Veracode Integration for Jira Cloud 4.14.0​

The Monitoring and Troubleshooting page now successfully displays imports from One Time Import and Selective Import.

May 10, 2024​

Veracode Scan for VS Code 1.9.0 - Pre-release​

This update is a pre-release that supports signing in to Veracode through a proxy server. Before you install this update, on the Visual Studio Code Marketplace, select Switch to Pre-Release Version.

May 3, 2024​

Veracode SCA Scan for JetBrains 0.8.1​

The debug option now successfully saves all logs.

May 2, 2024​

Veracode Static for Eclipse 3.9.0​

This update includes minor performance improvements.

April 18, 2024​

Veracode Scan for VS Code 1.8.1​

This update includes the following improvements:

  • The timeout limit for Static Analysis scans has increased to 10 minutes.
  • Fixed findings no longer appear on the PROBLEMS tab in VS Code.

April 17, 2024​

Veracode Static for Visual Studio 2019 and 2022 v1.12.0​

This update includes the following improvements:

  • After you import an XML file of your results into Visual Studio, the View Policy Results pane now shows the correct data paths.
  • If you use both the Greenlight extension and the Static Analysis extension in your IDE, you no longer experience conflicts between these extensions.

April 11, 2024​

Veracode SCA Scan for JetBrains 0.8.0​

This update includes a refreshed user experience.

April 10, 2024​

Veracode Workflow App 0.2.0 for GitHub​

This update includes the following improvements:

  • For policy and pipeline scans:
    • To turn on policy or pipeline scans, you must now add the analysis_on_platform true flag. By default, this feature is turned off.
    • By default, the analysis_branch flag is now set to your default branch automatically. You can set this flag to a different branch.
    • When you open a pull request (PR) against a branch you are scanning, the integration creates a sandbox scan from the source branch. You can view the scan results under the branch name in the Veracode Platform. When you merge the PR, the integration removes the sandbox scan, and then starts a new policy scan in the target branch. You can view the scan results under the repo name in the Veracode Platform.
    • Mitigated findings from a pipeline scan no longer appear in the list of findings.
  • For GitHub Issues:
    • New issues flag to enter a command that runs on-demand scans on a repo issue.
    • New create_issue flag that creates GitHub Issues from Static Analysis findings.
    • New create_code_scanning_alerts flag that creates code scanning alerts from Static Analysis findings. The alerts appear on the GitHub Security page.
  • For configuration options:
    • You can now configure an allowlist with in the central repo_list.yml file.
    • You can now override most global configurations by adding custom configurations to a veracode.yml file at the root of your source repo.
    • New use_custom_workflow flag that can use a workflow from the source repo to build the project or artifact you can upload for scanning.
  • For error handling:
    • New error messages that display as annotations if API credentials are invalid.
    • New error message when the integration is not able to find a policy name.
  • The integration now autopackages Java projects for more reliable builds and more accurate scan results.

Java API Wrapper 24.4.13.0​

This update includes the following improvements:

April 3, 2024​

Veracode Scan for VS Code 1.8.0​

This update includes the following improvements:

  • Adds Veracode Fix support for Kotlin and Scala.
  • The Flaw Details tab now renders correctly for .NET projects.
  • Minor improvements to packaging support.

April 1, 2024​

Veracode Integration for Jira Server 4.7.0​

You no longer see a NullPointerException error when you run a one-time import, selective import, or automated import.

March 28, 2024​

Veracode Static for Visual Studio 2019 and 2022 v1.11.0​

The integration now successfully verifies your Veracode API credentials.

March 25, 2024​

Veracode Scan for VS Code 1.7.0​

This update includes minor improvements to packaging support.

March 21, 2024​

Veracode Static for Visual Studio 2019 and 2022 v1.10.0​

In the Project Settings Wizard, when you select an application, the list of sandboxes now shows the sandboxes for the selected application only.

March 14, 2024​

Veracode Static for IntelliJ 3.6.0​

This update includes the following changes:

  • The Veracode option is now visible on the main menu.
  • Adds support for IntelliJ version 2023.3.4.

March 7, 2024​

Veracode Scan for VS Code 1.6.0​

This update includes the following improvements:

  • The debug option now supports Static Analysis scans, Veracode Fix, and the autopackager, in addition to SCA scans.
  • You can now clear all findings.
  • Minor performance improvements.

March 4, 2024​

Veracode Integration for Jira Cloud 4.13.2​

This update adds historical diagnostics data about each import to the Monitoring and Troubleshooting page.

February 29, 2024​

Veracode Jenkins Plugin 24.2.23.0​

This update improves security by increasing the minimum supported versions of Jenkins and Java. To install this update, you must have a minimum Jenkins version of 2.414.3 and Java 11.

February 28, 2024​

Veracode SCA Scan for JetBrains 0.7.2​

This update includes the following improvements:

  • You can now use a debug option to troubleshoot scan errors.
  • Minor performance improvements.

Veracode Greenlight for Visual Studio 2019 and 2022 v1.5.0​

This update includes the following improvements:

  • Scans no longer fail with this error message: “The selected file must be in a solution. Open the solution that contains this file and try again.”
  • Improved error handling.

February 23, 2024​

Veracode Integration for Jira Server 4.6.0 euro-icon.png us-fed-eagle-icon.png​

With this update, when you select links in Jira tickets that open application profiles located in the European region or United States Federal region, the links no longer open in the Commercial instance of the Veracode Platform.

February 20, 2024​

Veracode Azure DevOps Extension 3.26.0​

This update includes the following improvements:

  • Adds support for the includenewmodules parameter.
  • You can now add the following information as tags in work items: scan type, finding severity, due date, and CVE ID (SCA only).
  • Work items now show the correct CWE ID.
  • The Upload and Scan task no longer fails when you use the environment variable JAVA_TOOL_OPTIONS.

February 15, 2024​

Veracode Scan for VS Code 1.5.0​

This update adds Veracode Fix to Veracode Scan for VS Code. To fix flaws in seconds from within your IDE, you can now apply AI-generated fixes directly to flaws.

January 30, 2024​

Veracode Scan for VS Code 1.4.1​

This update includes the following improvements:

  • Fixes a typo in the Views and More Actions menu.
  • The Remediation Guidance text in the Flaw Details tab is now visible in light mode.
  • Minor performance improvements.

January 29, 2024​

C# API Wrapper 24.1.10.1​

This update adds support for the -includenewmodules parameter.

January 11, 2024​

Veracode Scan for VS Code 1.4.0​

This update adds Static Application Security Testing (SAST) to VS Code. Developers can use SAST to find and fix flaws in their code and use Software Composition Analysis (SCA) to find and fix vulnerabilities in open-source code from within the IDE.

This extension replaces Veracode SCA Scan for VS Code. Greenlight for VS Code is now deprecated and will not be supported after June 2024.

Previous updates​

2023 updates​

2023 updates

December 12, 2023​

Veracode Azure DevOps Extension 3.25.0​

This update includes the following improvements:

  • The Flaw Import task and the Upload and Scan task now successfully fail the build when the Fail build if Upload and Scan build step fails checkbox is selected.
  • Adds an option to overwrite the iteration path in work items of imported flaws during the next import.
Veracode Integration for Jira Server 4.5.0​

This update adds historical diagnostics data to the Monitoring and Troubleshooting page.

December 4, 2023​

Veracode GitHub Workflow App​

Veracode has released the Veracode Workflow App that allows you to scan your GitHub repositories with Static Analysis, Software Composition Analysis (SCA), and Container Security. The app uses template workflows in a centralized location that you can apply to all repositories across your organization.

The functionality of the app includes:

  • Automated scans of up to thousands of repositories from one location
  • Static, SCA, and Container Security scans start on developer activity from a single workflow
  • Automated scanning does not require developers to configure workflows for individual repositories
  • Broad language support

You can download the app from the GitHub marketplace. For more information, view the Veracode documentation.

December 1, 2023​

Veracode Static for Visual Studio 2019 and 2022 v1.9.0​

This update includes the following improvements:

  • Adds support for TSRV mitigations.
  • Adds support for .NET 7.

November 9, 2023​

Veracode SCA Scan for VS Code 1.3.1​

This update includes the following improvements:

  • You can now filter out any findings that are of low importance to your organization by selecting a security policy to apply to your project. To use this feature, your account must have the Unified Policy applied.
  • The Vulnerability Details window now includes a link to the related CVE.
  • You can now use a debug option to troubleshoot scan errors.
  • Minor interface changes.

November 1, 2023​

Veracode Integration for Jira Cloud 4.12.0​

This update includes the following changes:

  • The Import Automation page now includes an option for you to retry downloading Detailed Reports that failed to download during import.
  • If your account is in the European region and you select a link in a Jira issue to an application profile, the link now opens the Veracode Platform in the European region.
  • User accounts in the European region now see the correct values for various fields in imported Jira issues.

October 17, 2023​

Veracode SCA Scan for JetBrains 0.7.1​

This update includes minor performance improvements.

October 13, 2023​

Veracode SCA Scan for VS Code 1.2.1​

This update includes minor performance improvements.

October 4, 2023​

Veracode Integration for Jira Server 4.4.0​

This update adds support for Jira Server version 9.11.2.

September 26, 2023​

Veracode Azure DevOps Extension 3.24.0​

This update includes the following changes:

  • End of support for Team Foundation Server (TFS).
  • Builds no longer fail when the Fail build if flaw importer build step fails option is cleared and the application name contains special characters.

September 6, 2023​

Veracode Greenlight for IntelliJ 1.9.0​

This updates includes minor performance improvements.

August 31, 2023​

Veracode Integration for Jira Server 4.3.0​

This update includes the following improvements:

  • The Monitoring and Troubleshooting page now shows details about the last four imports.
  • The Monitoring and Troubleshooting page now includes an option for you to retry downloading Detailed Reports that failed to download during import.

August 17, 2023​

Java API Wrapper 23.8.12.0​

You can now send requests to the Identity REST API from within the Java API wrapper.

August 16, 2023​

Veracode Azure DevOps Extension 3.23.0​

This update includes the following improvements:

  • You can now add an iteration path to the work item settings in the Flaw Importer task.
  • Adds support for Azure DevOps version 2022 RC2.

August 10, 2023​

Veracode SCA Scan for JetBrains 0.7.0​

This update fixes a minor performance issue.

Veracode Integration for Jira Cloud 4.11.0​

This update includes the following improvements:

  • If an imported story for an open-source component with vulnerabilities changes projects, the integration now creates subtasks for SCA vulnerabilities in that story under the new project.
  • To avoid failed imports, if the integration encounters errors when it searches for linked Veracode fields, it now skips issue creation for any new findings.

August 8, 2023​

Veracode SCA Scan for VS Code 1.2.0​

This update includes the following improvements:

July 28, 2023​

Veracode Greenlight for IntelliJ 1.8.8​

This update includes the following improvements:

  • Adds support for IntelliJ version 1.8.7.
  • Exception errors no longer appear during Greenlight scans at the file or folder level.

July 27, 2023​

Veracode SCA Scan for JetBrains 0.6.1​

Veracode SCA Scan for JetBrains version 0.6.1 adds support for IntelliJ IDEA version 2023.2.

July 21, 2023​

Introducing Veracode SCA Scan for JetBrains​

Veracode SCA Scan for JetBrains version 0.6.0 is a new extension that integrates Software Composition Analysis (SCA) into the IntelliJ IDEA and PyCharm IDEs. Developers can scan their code to detect security risks in open-source libraries, library dependencies, and licenses. The detailed scan results help developers learn about vulnerabilities, prioritize security fixes, and remediate security issues from within their IDE.

July 20, 2023​

Veracode SCA Scan for VS Code 1.1.0​

This update includes the following improvements:

  • You can now select a project to scan when you have multiple projects in VS Code.
  • The SCAN OVERVIEW view now shows the name of the project you scanned.
  • In the extension settings, you can now enable or disable recursive scanning.
  • If your API credentials or the local SCA agent are invalid, the SETUP view now opens after you select Start Scanning or Rescan.
  • Spaces in the USER_HOME directory no longer result in an error.

July 14, 2023​

Veracode Integration for Jira Server 4.2.0​

This update fixes an issue where IssueCreatorImpl errors on the Monitoring and Troubleshooting page caused unexpected failures.

Veracode Jenkins Plugin 23.7.22.0​

This update includes the following improvements:

July 6, 2023​

Veracode Static for Visual Studio 2019 and 2022 v1.8.0​

This update includes the following improvements:

  • In the Static Findings window, when you double-click a finding, or right-click a finding and select Go to Line, the selected finding now remains selected.
  • After you add a new application to a project and scan it, the extension now adds the details about the new application to the file veracode-project-user.json.
Veracode Integration for Jira Server 4.1.0​

This update includes the following improvements:

  • The Import Automation now provides an option that attempts to import any flaws that failed to import. If an import fails, the Import Automation no longer uses the last import date of the failed import.
  • The Troubleshooting page now provides a diagnostic dashboard that shows details about the latest import, including information about any errors.

June 26, 2023​

Veracode Greenlight for Visual Studio 2019 and 2022 v1.4.0​

This update improves error handling.

June 15, 2023​

Veracode Greenlight for VS Code Adds Support for .NET 7​

See Veracode Greenlight for VS Code.

June 13, 2023​

C# API Wrapper 23.5.8.8​

You can now provide a proxy host, port, and its credentials in an environment variable. The environment variable name must be https_proxy.

June 5, 2023​

Veracode Azure DevOps Extension 3.22.0​

This update includes the following changes:

  • The Upload and Scan task now supports the optional parameter scanpollinginterval.
  • You can now configure the Flaw Import task to only import findings from Static Analysis and SCA.
  • Minor security improvements.
Veracode SCA Scan for VS Code 1.0.0​

This update adds security improvements.

June 1, 2023​

Veracode Jenkins Plugin 23.5.21.0​

This update includes the following changes:

  • Adds a Show Unstable Status for Failed Policy Evaluation option. Select this option to show the job status as Unstable if the scan succeeds but fails the security policy.
  • Minor security improvements.

May 22, 2023​

Veracode Integration for Jira Cloud 4.10.0​

This update includes the following changes:

  • Findings you import with the Import Automation feature now show the date of the last successful import, instead of the last import.
  • When you configure a Selective Import and select the left/right arrows to switch between pages, the selected flaws are no longer cleared.
  • Minor security fixes.

May 4, 2023​

Veracode Azure DevOps Extension 3.21.0​

This update includes the following changes:

  • Adds support for the lifecyclestage parameter as an optional argument in the Upload and Scan task. This parameter is not supported in YAML.
  • The scan polling interval for the Upload and Scan task is no longer twice the expected default value of 120 seconds.

April 27, 2023​

Veracode SCA Scan for VS Code 0.8.0​

This update includes the following improvements:

  • You can now filter the VULNERABILITIES view based on direct or transitive libraries.
  • The Rescan button is now located at the top of the SCAN OVERVIEW view.
  • The SCAN OVERVIEW view is no longer empty when the scan does not find vulnerabilities.
  • In the Library Details window, the Last published field now shows the months and days since the vendor last published the library or it shows Unknown.

April 19, 2023​

Veracode Jenkins Plugin 23.4.20.0​

This version includes the following updates:

  • Adds Dynamic Analysis scan statuses STOPPED_VERIFYING_PARTIAL_RESULTS and STOPPED_PARTIAL_RESULTS_AVAILABLE.
  • Fixes an issue where the scan poll interval for upload and scan was twice the expected default value of 120 seconds.

April 13, 2023​

Veracode Integration for Jira Cloud 4.9.0​

The integration now imports findings from scanned applications with COTS (commercial off-the-shelf) enabled.

April 5, 2023​

Java API Wrapper 23.4.11.2​

This update includes the following changes:

March 31, 2023​

Veracode Static for Eclipse 3.8.0​

This update adds support for Eclipse IDE version 2023-03.

March 30, 2023​

Veracode Integration for Jira Cloud 4.8.0​

This version includes the following changes:

  • Adds additional logs for troubleshooting.
  • To ensure your imported flaws are current, the integration re-imports them after you fix any configuration issues.
  • On the Selective Import page, the Flaws Per Page and Next Page options no longer show an error message.

March 27, 2023​

Veracode Jenkins Plugin 23.3.19.0​

This version includes the following changes:

  • Addresses the low severity information disclosure issues detailed in CVE-2023-25721 and CVE-2023-25722. For more information, go to the Veracode Community.
  • Correctly escapes the -ppassword parameter for a proxy password.
Veracode Azure DevOps Extension 3.20.0​

This version addresses the low severity information disclosure issue detailed in CVE-2023-25722. For more information, go to the Veracode Community.

March 20, 2023​

Veracode SCA Scan for VS Code 0.7.0​

This update includes the following improvements:

  • The extension now includes an SCA Agent. After you install the extension, you can install the SCA Agent from within the IDE and start scanning.
  • You can point to a vulnerability in the VULNERABILITIES view to see whether it passes the built-in policy.
  • The Vulnerability Details window now shows the policy for the selected vulnerability.
  • To indicate which vulnerabilities have passed the built-in policy, the VULNERABILITIES view now groups them by Did Not Pass Policy and Passed Policy.

March 8, 2023​

Java API Wrapper 23.3.11.0​

This version includes the following changes:

March 2, 2023​

Veracode Azure DevOps Extension 3.19.0​

This update adds support for both of the following YAML property values:

  • ConnectionDetailsSelection='Endpoint'
  • ConnectionDetailsSelection='Service Connection'

March 1, 2023​

Veracode Azure DevOps Extension 3.18.0​

This update includes the following changes:

  • Changes the YAML property value ConnectionDetailsSelection='Endpoint' to ConnectionDetailsSelection='Service Connection'. When you upgrade to this new extension, you must update your YAML with the new value name.
  • Static Analysis work items now have a Grace Period Expiration field.
  • SCA works items now have a First Found Date field and File Path field for vulnerabilities.
  • The Summary Report now shows a link to the Scan Details page.
  • The extension now fails the build if Development Sandbox scans find SCA vulnerabilities.
  • Builds no longer fail when the Fail build if Upload and scan build steps fails option is cleared, but the application name contains special characters.

February 28, 2023​

Veracode Greenlight for IntelliJ Supports IntelliJ v2022.2.3​

Veracode Greenlight v1.8.7 adds support for IntelliJ v2022.2.3.

February 22, 2023​

Updated Identity REST API​

You can now use the Identity REST API to manage Veracode API credentials for API service accounts, also called API users.

February 9, 2023​

Updated Veracode SCA Scan for VS Code​

Veracode SCA Scan for VS Code version 0.6.0 includes the following updates:

  • Adds a Create a Case link that you can use to send a support case to Veracode Technical Support.
  • Adds a Leave Feedback link that you can use to provide feedback in a survey.
  • Fixes an issue where the extension did not verify undefined or null values.

February 3, 2023​

Mandatory Upgrade for Veracode Greenlight for IntelliJ​

Veracode Greenlight for IntelliJ version 1.8.6 supports a recent change to the Greenlight API. To continue using this plugin, you must upgrade to this version by February 13, 2023.

February 2, 2023​

Mandatory Upgrade for Veracode Greenlight for Eclipse​

Veracode Greenlight for Eclipse version 2.9.7 includes these changes:

  • Supports a recent change to the Greenlight API. To continue using this plugin, you must upgrade to this version by February 13, 2023.
  • Fixes a refresh issue that flashes various status messages at the bottom of the Eclipse interface.

February 1, 2023​

Updated Java API Wrapper​

Veracode Java API Wrapper version 23.1.10.5 adds logic to identify and remove unicode application names from the XML response.

Veracode Mobile Application Packager Has Reached End of Life​

Veracode Mobile Application Packager is now End of Life (EOL) and is no longer supported by Veracode Technical Support. To compile and package tvOS or iOS applications that you developed in the Xcode IDE, see the packaging requirements.

January 30, 2023​

Mandatory Greenlight Upgrades for Eclipse and IntelliJ​

Veracode has made a change to the Greenlight API that will impact the following plugins.

  • Veracode Greenlight for Eclipse version 2.9.6 and earlier
  • Veracode Greenlight for IntelliJ version 1.8.5.2022 and earlier

New versions of these plugins will be available on February 2, 2023 and February 3, 2023, respectively. To continue using these plugins, you must upgrade to the new versions by February 13, 2023.

January 23, 2023​

Veracode Integration for Jira Supports Jira Server 9​

Veracode Integration for Jira version 4.0.1 adds support for Jira Server 9. This integration no longer supports Jira Server 8.6.0 and earlier.

January 17, 2023​

Introducing Veracode SCA Scan for VS Code​

Veracode SCA Scan for VS Code version 0.5.0 is a new extension that integrates Software Composition Analysis (SCA) into VS Code. Developers can scan their code to detect security risks in open-source libraries, library dependencies, and licenses. The detailed scan results help developers learn about vulnerabilities, prioritize security fixes, and remediate security issues from within their IDE. Version 0.5.1 only removes an obsolete README.

January 10, 2023​

Renaming the ConnectionDetailsSelection='Endpoint' YAML Property​

In February 2023, Veracode will release a new Azure DevOps Extension that uses the YAML property value ConnectionDetailsSelection='Service Connection' rather than the current value ConnectionDetailsSelection='Endpoint'. When upgrading to this new extension, you must update your YAML with the new value name.

January 5, 2023​

Improved Veracode Azure DevOps Extension​

Veracode Azure DevOps Extension version 3.17.0 includes the following improvements:

  • Renamed the Veracode Analysis Center link to Veracode Platform.
  • The extension no longer fails a pipeline build if it has a policy assessment of Conditional Pass, even if the Fail build if application fails security policy checkbox is selected.
  • Fixed a minor error-handling issue when the build artifact directory is empty.
  • The Flaw Import task now fails the build when importing flaws with an unsupported process template and the Fail build if flaw importer build step fails checkbox is selected.

January 3, 2023​

Improved Veracode Integration for Jira Cloud​

Veracode Integration for Jira Cloud version 4.7.0 now successfully loads the Findings Import page when importing large Jira projects.

2022 updates​

2022 updates

December 19, 2022​

Improved Veracode Integration for Jira Server​

Veracode Integration for Jira Server version 3.38.0 includes the following improvements:

  • Jira tickets from imported Static Analysis flaws now show the detected CWEs with a dash instead of an underscore. This CWE format matches the results in the Veracode Platform. For example, CWE_123 is now CWE-123.
  • Jira tickets from imported SCA vulnerabilities now support the Mitigation Status and Mitigation Status Description fields.

December 15, 2022​

Veracode Mobile Application Packager is Deprecated​

Veracode Mobile Application Packager is now deprecated and will be obsolete on February 1, 2023.

December 14, 2022​

Veracode for VS Code Renamed to Veracode Greenlight for VS Code​

Veracode for VS Code version 1.6.0 includes the following updates:

  • Changed the name of the extension to Veracode Greenlight for VS Code.
  • Using File > Save on a single file now saves only that file, not all unsaved files.

December 13, 2022​

Veracode Azure DevOps Extension version 3.16.0 fixes the link on the Veracode Scan Summary tab. The link now opens the scan results in the Veracode Platform instead of the Application page.

December 6, 2022​

Updated Veracode Static for Visual Studio​

Veracode Static for Visual Studio version 1.7.0 fixes an issue where the extension could not authenticate with Veracode from a European Region instance.

November 16, 2022​

Updated Veracode Integration for Jira​

Veracode Integration for Jira version 3.37.0 fixes an issue where the plugin ignores all remaining applications after attempting to import findings from an application with COTS enabled.

November 14, 2022​

Updated C# API Wrapper​

Veracode C# API wrapper version 22.10.8.6 includes these updates:

  • Fixed an error that can occur if the filename of an uploaded file contains certain characters or symbols. For example, ~ ^ ' { }
  • The -debug parameter now logs timestamped messages that identify connectivity issues, error conditions, and the status of various composite actions.
Improved Veracode Greenlight for IntelliJ​

Veracode Greenlight for IntelliJ version 1.8.5 adds support for IntelliJ IDEA 2022.2.3.

October 27, 2022​

Java API Wrapper Has Improved Error Handling​

Veracode Java API Wrapper version 22.10.10.4 now cancels any scans that exceed the upload limit.

October 21, 2022​

Veracode Azure DevOps Extension Now Supports Automatic Deletion of Incomplete Scans​

Veracode Azure DevOps Extension version 3.15.0 adds options for deleting incomplete scans in your pipeline. When configuring the extension, you can add -deleteincompletescan as an optional argument or add -deleteIncompleteScan as a YAML property.

Updated Veracode Static for Visual Studio​

Veracode Static for Visual Studio 2019 and 2022 version 1.6.0 includes these changes:

  • Fixed an issue where web projects inside folders did not publish.
  • Fixed an issue where the scan progress bar in the IDE displayed as incomplete after clicking Custom Workflow.
  • Run Scan button in the IDE is now disabled when the scan status is in a failed state. In the Veracode Platform, you also see a warning message to resolve this issue.

September 29, 2022​

Updated Greenlight for Eclipse​

Greenlight for Eclipse version 2.9.6 includes minor security and documentation updates.

September 22, 2022​

Improved Finding Import Performance for Veracode Integration for Jira Cloud​

Veracode Integration for Jira Cloud version 4.6.0 adds a new filter that only imports findings with new scan data, policy changes, or changes to applied mitigations since the last import.

September 13, 2022​

Java API Wrapper JavaDoc Update​

In Veracode Java API Wrapper version 22.9.10.3 the documentation available in the wrapper installation file now describes the Credentials class.

August 29, 2022​

Veracode Azure DevOps Extension Has Improved Flaw Importer Task​

Veracode Azure DevOps Extension version 3.14.0 includes the following improvements to the Flaw Importer Task.

  • Uses fewer calls to complete flaw imports.
  • Fixes an issue where flaws without comments did not sync or close.
  • Fixes an issue where development sandbox findings did not import.

August 12, 2022​

Veracode TeamCity Plugin Now Supports Automatic Deletion of Incomplete Scans​

Veracode TeamCity Plugin version 2.7.0 adds configuration options for deleting incomplete scans.

August 9, 2022​

Veracode Integration for Jira Server Now Retries Downloading the Detailed XML Report​

Veracode Integration for Jira version 3.36.0 fixes an issue where the integration did not create tickets of imported flaws if it could not retrieve the Detailed XML Report. The integration now attempts to retrieve the Detailed XML Report during the next import cycle.

July 27, 2022​

Updated C# API Wrapper​

Veracode C# API wrapper version 22.8.8.5 includes these updates:

  • Supports the -debug parameter.
  • Fixes an issue to filter out Dynamic Analysis results.
  • Adds transaction ID header to uploadandscan.

July 20, 2022​

Veracode Azure DevOps Extension Now Supports Importing SCA Vulnerabilities as Work Items​

Veracode Azure DevOps Extension version 3.13.0 updates the Flaw Importer task to support importing Software Composition Analysis (SCA) vulnerabilities as work items.

July 14, 2022​

Veracode Jenkins Plugin Now Supports Automatic Deletion of Incomplete Scans​

Veracode Jenkins Plugin version 22.6.18.0 adds configuration options for deleting incomplete scans.

June 27, 2022​

Improved Finding Import Performance for Veracode Integration for Jira Server​

Veracode Integration for Jira Server version 3.35.0 adds a new filter that only imports findings with new scan data, policy changes, or changes to applied mitigations since the last import.

June 22, 2022​

Deprecation of Admin XML APIs​

Veracode has deprecated the Admin XML APIs for user and team management. End-of-support for these APIs is scheduled for June 30, 2023. Veracode recommends that you begin updating your automations to use the Identity REST APIs. Also, enabling the Single Sign-on and Just-in-Time Provisioning feature automatically disables the Admin XML APIs for user management. Before enabling this feature, ensure all of your automations are using the Identity APIs.

June 8, 2022​

Updated Veracode Static for Visual Studio (New)​

Veracode Static for Visual Studio (New) version 1.5.0 includes these changes:

May 18, 2022​

Java API Wrapper Updates -deleteincompletescan Parameter with Backward Compatibility​

Java API Wrapper version 22.5.10.1 updates the -deleteincompletescan parameter to be backward compatible with Java API wrapper versions earlier than 22.5.10.0, which released on May 4, 2022. After upgrading the wrapper, the parameter value automatically changes from boolean to an integer:

  • If set to true, the value changes to 1.
  • If set to false, the value changes to 0.

May 4, 2022​

Java API Wrapper Has Improved -deleteincompletescan Parameter​

Java API Wrapper version 22.5.10.0 includes changes to the -deleteincompletescan parameter for deleting incomplete scans when running the uploadandscan action. This parameter now accepts an integer value, rather than boolean, for deleting an incomplete scan based on the scan status.

note

These changes are not backward compatible with the -deleteincompletescan parameter available in earlier versions of the Java API Wrapper. If you currently use this parameter, after upgrading the wrapper you must change the value from boolean to one of the accepted integer values.

April 15, 2022​

Introducing New Veracode Static Extensions for Visual Studio 2019 and 2022​

Veracode Static for Visual Studio version 1.4.0 is a new extension for adding Static Analysis to Visual Studio 2019 and 2022. The new extension for Visual Studio 2019 provides major improvements compared to our current legacy extension for version 2019, which Veracode continues to support.

The extensions include these features:

  • Improved user experience for developers.
  • Powerful Summary View grid for reviewing and managing findings.
  • Streamlined workflow for building, packaging, and scanning your code.
  • Support for policy and sandbox scans.

An extension for each Visual Studio version is available from the Visual Studio Marketplace.

April 12, 2022​

Veracode Greenlight Now Supports the New Visual Studio 2019 and 2022​

Veracode Greenlight for Visual Studio version 1.3.184.96 is a new extension for adding Greenlight scanning to the newer versions of Visual Studio 2019 and 2022. An extension for each Visual Studio version is available from the Visual Studio Marketplace.

March 9, 2022​

Updated Azure DevOps Extension​

Veracode Azure DevOps Extension version 3.10.0 includes these changes:

  • TFS 2017 is no longer supported.
  • TFS 2018 support now requires Azure Pipeline Agent 2.196.2 or later.
  • Flaw Importer task can now import custom fields when using custom process templates.
  • Flaw Importer task can now overwrite the area path in work items when importing flaws.

2021 updates​

2021 updates

December 10, 2021​

Veracode Integration for CA Agile Central/Rally Now End-of-Life​
  • The Veracode Integration for CA Agile Central/Rally is now end-of-life and no longer supported. The plugin and documentation are no longer available. To avoid potential security vulnerabilities, Veracode strongly recommends that you uninstall this integration. To integrate with other ticketing systems, visit the Veracode Integrations Hub.

November 22, 2021​

Java API Wrapper Now Retries Requests​
  • Veracode Java API Wrapper version 21.11.9.0 updates the maxretrycount parameter to now retry requests that fail due to certain error conditions. Previously, this parameter polled for failed build status and only applied to the uploadandscan action.

October 18, 2021​

Veracode Greenlight for IntelliJ Supports Additional IntelliJ IDEA Versions​
  • Veracode Greenlight for IntelliJ version 1.7.0 adds support for IntelliJ IDEA 2019.3–2021.2.3. If you are using IntelliJ IDEA 2020 or later, you must install JavaFX Runtime for Plugins.

October 8, 2021​

Improved Veracode Greenlight for IntelliJ​
  • Veracode Greenlight for IntelliJ version 1.6.0 adds support for IntelliJ IDEA 2019.3–2021.1.3. If you are using IntelliJ IDEA 2020 or later, you must install JavaFX Runtime for Plugins.

July 8, 2021​

New Video - Use the Jenkins Credentials Binding Plugin to Protect Your Veracode Credentials​

This video shows you how to:

  • Use the Jenkins Credentials Binding plugin to bind your Veracode API credentials to environment variables
  • Generate a script containing the bound environment variables
  • Add this script to your Jenkins pipeline script

June 23, 2021​

Veracode Integration for Jira Supports the Jira Select List Field Type for Multiple Choices​
  • The Veracode Integration for Jira version 3.30.0 adds support for the Select List (multiple choices) field type. You can use this field type to map data from Veracode custom fields or a Veracode Detailed XML report to standard or custom fields in Jira Server issues.

May 18, 2021​

Veracode Integration for Jira Cloud Supports the Select List Field Types​
  • The Veracode Integration for Jira Cloud version 3.7.0 adds support for the Select List (single choice) and Select List (multiple choices) field types. You can use these field types to map data from Veracode custom fields or a Veracode Detailed XML report to standard or custom fields in Jira Cloud issues.

April 30, 2021​

Veracode Azure DevOps Extension Has Renamed YAML Property and Improved Logging​

Veracode Azure DevOps Extension version 3.5.0 includes these changes:

  • For YAML pipelines with the Flaw Importer task, Veracode renamed the optargs property to proxySettings. This new name more accurately identifies the valid values for this property. Ensure you update your pipelines with this new property name.
  • Added logs, with error messages, for invalid or missing values. The errors apply to both standard and YAML pipelines.

April 22, 2021​

Java API Wrapper Adds Parameter for Deleting Incomplete Scans Automatically​

Veracode Java API Wrapper version v21.2.7.5 includes these changes:

  • New deleteincompletescan parameter for automatically deleting scans that did not complete due to one or more errors.
  • Additional debug logs for troubleshooting upload and scan issues.

April 20, 2021​

Veracode Integration for Jira Supports the Select List Field for a Single Choice​
  • The Veracode Integration for Jira version 3.29.0 adds support for the Select List (single choice) field type. You can use this field type to map data from Veracode custom fields or a Veracode Detailed XML report to standard or custom fields in Jira issues.

March 24, 2021​

Veracode Greenlight for VS Code Now Requires the JRE​
  • Veracode Greenlight for VS Code version 1.4.0 introduces a change that requires you to install a current version of the Java Runtime Environment (JRE) and set your Java PATH.

March 19, 2021​

New Video - Create and Manage API Service Accounts with the Identity API]​

This video shows you how to:

  • Create an API service account
  • Create teams
  • Assign user roles and teams to API service accounts
  • Update an API service account

February 23, 2021​

Updated Video - Working with Scan Results Using Veracode Static for Visual Studio​
  • This video shows you how to download, import, and view Veracode scan results using Veracode Static for Visual Studio. You can also learn how to mitigate findings discovered during the scan in Visual Studio.
Veracode Jenkins Plugin No Longer Encrypts Non-Sensitive Data for Build Jobs​
  • Starting with Veracode Jenkins Plugin version 21.2.12.0, the plugin no longer encrypts non-sensitive data stored in the config.xml file for a build job. This change enables you to import jobs between Jenkins instances.

February 5, 2021​

Updated Veracode Azure DevOps Extension​

Veracode Azure DevOps Extension version 3.4.0 includes these updates:

  • Use YAML to add Veracode analysis to build pipelines.
  • Use YAML to import findings as work items into Azure DevOps.
  • Include mitigation and annotation comments when importing new findings as work items.
  • Set a timeout to fail a build if Veracode analysis does not complete within a specified time.

2020 updates​

2020 updates

December 23, 2020​

Updated Video - Build and Upload Files to Scan Using Veracode Static for Visual Studio​
  • This video shows you how to prepare a build of your application using Veracode Static for Visual Studio and upload the build to a new or existing application profile in your Veracode portfolio.

December 17, 2020​

Veracode Static for IntelliJ Supports Mitigation Proposals in TSRV Format​
  • Veracode Static for IntelliJ version 3.2.1 now supports submitting mitigation proposals using the Technique, Specifics, Remaining Risk, and Verification (TSRV) format. If you have a Mitigation Proposal Review (MPR) subscription, you are required to use the TSRV format when proposing mitigations from within IntelliJ.

December 11, 2020​

Veracode Java Wrapper Provides Improved Diagnostic Information​
  • The Veracode Java wrapper version 20.12.7.3 provides improved debug-level, diagnostic information. You can include the debug parameter in your command to show this diagnostic information in the output.
New REST APIs for Findings, Development Sandboxes, and Summary Reports​

Veracode now provides these REST APIs:

  • Annotations API for commenting on findings and proposing, accepting, and rejecting mitigations. You can combine this API with the Findings API to manage applications.
  • Development Sandbox API for creating, updating, and deleting sandboxes. You can combine this API with the Applications API to manage both applications and sandboxes.
  • Additional Findings APIs for obtaining detailed findings information for a static analysis or dynamic analysis and generating Summary Reports.

December 9, 2020​

New Video - Reviewing Findings in Veracode Greenlight for VS Code​

This video shows you how to:

  • Link findings in source code
  • Filter Veracode findings
  • Ignore findings in Veracode Greenlight for VS Code results
  • Stop ignoring findings in Veracode Greenlight for VS Code results

November 19, 2020​

Docker Hub Images for the Java API Wrapper, the Python Authentication Library, and the Pipeline Scan​

Veracode now provides these products as container images on Docker Hub:

  • Java API wrapper
  • Python authentication library to enable HMAC for Veracode APIs
  • Pipeline Scan
Veracode Static for Eclipse Now Supports Mitigation Proposals in TSRV Format​
  • Veracode Static for Eclipse version 3.5.0 now supports submitting mitigation proposals using the Technique, Specifics, Remaining Risk, and Verification (TSRV) format. If you have a Mitigation Proposal Review (MPR) subscription, you are required to use the TSRV format when proposing mitigations from within Eclipse.
Veracode Integration for Jira Cloud Improves Findings Import Options​

The Veracode Integration for Jira Cloud version 3.5.0 includes these improvements:

  • Uses mapped custom fields in the Veracode Platform when assigning issues of imported findings. If Veracode custom fields are not mapped to Jira fields, Jira Cloud assigns the issues to the default assignee for the Jira project.
  • Adds the ability to map Jira Cloud fields to Veracode Platform fields for SCA components and SCA vulnerabilities.

October 6, 2020​

Install Veracode Greenlight for VS Code to Run Greenlight Scans​
  • This video shows you how to how to install the Veracode Greenlight for VS Code extension. The Veracode Greenlight for VS Code extension is available from the Visual Studio Marketplace.

October 1, 2020​

Veracode Static for IntelliJ Supports the Veracode API Credentials File​
  • Veracode Static for IntelliJ version 3.2.0 allows you to store your Veracode API credentials securely in an external file.

September 30, 2020​

Introducing Veracode for GitHub​
  • Veracode for GitHub enables you to use GitHub Actions for performing static analysis of your application source code from within GitHub. Veracode provides preconfigured GitHub Actions for uploading your code to Veracode for static analysis or running a pipeline scan from within your GitHub development workflow.

September 24, 2020​

Veracode Static for Eclipse Supports the Veracode API Credentials File​
  • Veracode Static for Eclipse version 3.4.1 allows you to store your Veracode API credentials securely in an external file.

September 11, 2020​

Veracode Integration for Jira Cloud Adds Description Field Override Option​
  • The Veracode Integration for Jira Cloud version 3.4.0 adds the global option for overriding the Description field in Jira issues. When importing findings as issues into Jira Cloud, this option replaces any content in the issue Description field with your provided text.

September 10, 2020​

Veracode Greenlight for Eclipse Free Trial Option Removed​
  • Veracode Greenlight for Eclipse version 2.8.8 removes the free trial option from the Eclipse plugin. Veracode no longer provides a free trial of Greenlight for the Eclipse IDE.

August 29, 2020​

Changes to deletesandbox.do and deletebuild.do XML API Calls​
  • To improve the performance of the deletebuild.do and deletesandbox.do XML API calls, these calls now return an HTTP 200 response and a summary of the deleted items, instead of a list of items remaining after deletion. These calls also use new schema files.

August 13, 2020​

Veracode Integration for Jira Adds Description Field Override Option​
  • The Veracode Integration for Jira version 3.25.0 adds the global option for overriding the Description field in Jira issues. When importing findings as issues into Jira Server, this option replaces any content in the issue Description field with your provided text.

August 12, 2020​

New Video - Configure the Veracode API Credentials file on Windows​
  • This video shows you how to generate Veracode API credentials in the Veracode Platform and configure a Veracode API credentials file for storing your Veracode API credentials on Windows.
New Video - Configure the Veracode API Credentials File on macOS and Linux​
  • This video shows you how to generate Veracode API credentials in the Veracode Platform and configure a Veracode API credentials file for storing your Veracode API credentials on macOS and Linux.

July 28, 2020​

Veracode C# API Wrapper Supports the Veracode API Credentials File​
  • The Veracode C# API wrapper version 20.7.8.0 now supports the Veracode API credentials file for storing your API credentials securely in an external file. If your API credentials file contains multiple credentials, you can use the new -credprofile parameter to specify the profile to use for Veracode authentication. The existing -vid and -vkey parameters, for specifying your API credentials at the command line, are now optional.

July 23, 2020​

Veracode Java API Wrapper Supports the Veracode API Credentials File​
  • The Veracode Java API wrapper version 20.7.7.0 now supports the Veracode API credentials file for storing your API credentials securely in an external file. If your API credentials file contains multiple credentials, you can use the new -credprofile parameter to specify the profile to use for Veracode authentication. The existing -vid and -vkey parameters, for specifying your API credentials at the command line, are now optional.

June 25, 2020​

Introducing Veracode for AWS CodeStar​
  • Veracode for AWS CodeStar version 1.0.0 enables you to add Veracode Static Analysis and Veracode Software Composition Analysis (SCA) as a build stage in your AWS CodePipeline. You can review the results of each analysis in the Veracode Platform.
Veracode Integration for Jira Improves Issue Assignment of Imported Findings​
  • The Veracode Integration for Jira version 3.24.0 can now use mapped custom fields in the Veracode Platform when assigning issues of imported findings. If Veracode custom fields are not mapped to Jira fields, Jira Server assigns the issues to the default assignee for the Jira project.

June 16, 2020​

Veracode Jenkins Plugin Now Open Source and on Jenkins Marketplace​
  • The Veracode Jenkins Plugin version 20.6.10.0 is an open-source plugin that Veracode is distributing with an MIT license. You can download the plugin from both the Jenkins Marketplace and the Plugin Manager within Jenkins. The plugin source code is available from GitHub.

June 10, 2020​

Introducing Veracode for Artifactory

The new Veracode for Artifactory version 1.3.0 allows you to perform security scanning of your application artifacts from within Artifactory. This release includes these features:

  • Static analysis of your application artifacts from within Artifactory using manual scans, scheduled scans, or event-triggered scans.
  • Support for Artifactory High Availability (HA) clusters.
  • Python script to automate tagging artifacts with the required properties for static analysis.

May 29, 2020​

Veracode Integration for Jira Cloud Adds Findings Import Options​

The Veracode Integration for Jira Cloud version 3.3.0 adds these new options for importing findings from Veracode to Jira Cloud:

  • Automatically assign imported findings to a Jira Cloud epic or link them to a related issue.
  • Map string, number, and date/time data types from Veracode fields to text, number, and date/time field types in Jira Cloud. The integration imports the values from the Veracode fields to fields in Jira Cloud issues.

May 28, 2020​

Veracode Greenlight for IntelliJ Supports IntelliJ 2020.1​
  • Veracode Greenlight for IntelliJ version 1.5.3 adds support for IntelliJ IDEA Ultimate and Community 2020.1. This release also allows you to store your Veracode API credentials in an external file.

May 21, 2020​

Veracode Greenlight for Eclipse Supports Eclipse 2020-03​
  • Veracode Greenlight for Eclipse version 2.8.7 adds support for Eclipse 2020-03 and allows you to store your Veracode API credentials in an external file.

May 19, 2020​

Veracode Azure DevOps Extension Adds New Scan Summary for Multi-Stage Pipelines​
  • The Veracode Azure DevOps Extension version 3.1.0 shows scan results in a new Veracode Scan Summary tab to support multi-stage pipelines.

May 7, 2020​

Veracode Integration for Jira Adds Findings Import Options​

The Veracode Integration for Jira version 3.23.0 adds these new options for importing findings from Veracode to Jira Server or Jira Data Center:

  • Automatically assign imported findings to a Jira epic or link them to a related issue.
  • Map string, number, and date/time data types from Veracode fields to text, number, and date/time field types in Jira. The integration imports the values from the Veracode fields to fields in Jira issues.

April 10, 2020​

Veracode Integration for Jira Supports Jira Server 8.7.x​
  • The Veracode Integration for Jira version 3.22.1 adds support for Jira Server and Jira Data Center 8.7.x.
Updated Video - Install Veracode Static for Visual Studio​

This video shows you how to:

  • Install Veracode Static for Visual Studio
  • Generate API credentials in the Veracode Platform
  • Configure an API credentials file for storing your API credentials

March 24, 2020​

Veracode Azure DevOps Extension Removes Basic Authentication​
  • The Veracode Azure DevOps Extension version 3.0.0 removes basic authentication. Basic authentication consists of only a username and password. You must now use Veracode API ID and key authentication. Any custom integration scripts must also include HMAC signing.

February 21, 2020​

Veracode Greenlight for Eclipse Supports Eclipse IDE 2019-12​
  • Veracode Greenlight for Eclipse version 2.8.6 adds support for Eclipse IDE 2019-12 (4.14).

February 14, 2020​

Veracode Greenlight for IntelliJ Supports IntelliJ IDEA 2019.3​
  • Veracode Greenlight for IntelliJ version 1.5.1 adds support for IntelliJ IDEA Ultimate and Community 2019.3.

February 12, 2020​

Veracode Jenkins Plugin Removes Basic Authentication​
  • The Veracode Jenkins Plugin version 20.2.6.1 removes basic authentication. Basic authentication consists of only a username and password. You must now use Veracode API ID and key authentication. Any custom integration scripts must also include HMAC signing.

January 31, 2020​

Veracode Static for Eclipse Supports Eclipse 2019-09​

  • Veracode Static for Eclipse version 3.4.0 replaces the Veracode Eclipse Plugin. This version adds support for Eclipse 2019-09. It also adds support for Java Runtime Environment (JRE) 11 and 13.

  • You can no longer use basic authentication. Basic authentication consists of only a username and password. You must now use Veracode API ID and key authentication. Any custom integration scripts must also include HMAC signing.

January 24, 2020​

Veracode Static for IntelliJ Supports IntelliJ IDEA 2019.3​

  • Veracode Static for IntelliJ version 3.0.0 replaces the Veracode IntelliJ Plugin. This version supports IntelliJ IDEA Ultimate and Community 2017.x to 2019.3. It also adds support for Java Runtime Environment (JRE) 11 and 13.

  • You can no longer use basic authentication. Basic authentication consists of only a username and password. You must now use Veracode API ID and key authentication. Any custom integration scripts must also include HMAC signing.

January 23, 2020​

Updated Veracode Integration for Jira​

The Veracode Integration for Jira version 3.22.0 includes these updates:

  • Removes support for basic authentication. Basic authentication consists of only a username and password. You must now use Veracode API ID and key authentication. Any custom integration scripts must also include HMAC signing.
  • Enhances Jira logging, so that you can more easily read the logs.
  • Improves the performance of importing findings from the Veracode Platform to Jira using custom fields.

January 17, 2020​

Veracode Static for Visual Studio Supports Visual Studio 2019​

  • Veracode Static for Visual Studio version 4.0.0.1 replaces the Veracode for Visual Studio Extension. This version supports Visual Studio 2015, 2017, and 2019. In Visual Studio 2015 and 2017, the name of the top-level Veracode menu is now Veracode Static. In Visual Studio 2019, the Veracode Static menu appears under the Extensions menu.

  • You are required to configure an API credentials file, which you use to provide your Veracode API ID and key credentials to Veracode Static for Visual Studio.

January 8, 2020​

Updated Veracode Integration for Jira Cloud​

The Veracode Integration for Jira Cloud version 3.2.0 includes these updates:

  • Adds a new Veracode Integration Severity Mappings page in the Jira Cloud interface for mapping severities from the Veracode Platform to your customized priorities in Jira Cloud.
  • On the Veracode Integration Field Mapping page in the Jira Cloud interface, the Veracode Platform column adds these new options:
  • A Description (overwrite) option to have the content from a selected Veracode Platform field overwrite the Description field in Jira Cloud upon import. If the selected Veracode Platform field is empty, the mapping erases the contents of the Description field in Jira Cloud.
  • An option for mapping Veracode SCA component paths.
  • Removes basic authentication. Basic authentication consists of only a username and password. You must now use Veracode API ID and key authentication. Any custom integration scripts must also include HMAC signing.

Developer Training​

View the list below for highlights of previous releases.

November 23, 2020​

Auto-Extend for eLearning Enabled by Default​
  • The default setting for new Veracode eLearning course track assignments is to automatically extend when their subscription periods end.
Improved eLearning Performance​
  • Veracode has increased the loading speed of the My Team's Courses page in Veracode eLearning.

October 29, 2020​

Improvements to eLearning​

Veracode has made these improvements to eLearning:

  • eLearning administrators can now assign a learner to multiple eLearning curricula.
  • Veracode added seven new Secure Coding Foundation courses to learner level 1. Learners who previously completed level 1 must take the newly-added courses to complete this level. Because each level depends on the previous level, these levels show as incomplete until the learner completes them.
  • The eLearning report for learners now includes a Date Started column.
  • The eLearning settings have been removed from the Admin > Manage Users page. All eLearning administration actions are now available from the Admin > eLearning page. This page provides a centralized location where you can use filtering options and perform all actions on one or more learners.
  • The eLearning fields have been removed from the SAML Self-Registration page.

August 29, 2020​

Improvements to Security Labs​

Veracode has made these improvements to Security Labs:

  • Integration with the Veracode Platform. By default, if you have the Security Labs User role, Veracode automatically creates your Security Labs account in the Platform. If you have the Administrator role, you automatically have administrator permissions within Security Labs.
  • New Assignment Creation wizard. When creating a new set of lab assignments on the Assign Content page, you can now get suggested lab assignments based on a focus. For example, Beginner/Intermediate/Advanced, PCI Training, Backend/Frontend, or Competition.
  • New Scala labs for the OWASP Top 10. These labs use the Play framework.

June 27, 2020​

Enhancements to eLearning Curriculum Creation​
  • Veracode has improved the user interface for creating an eLearning curriculum to make it easier for administrators to identify courses to add to a curriculum. The new user interface now includes the length and description of each course. When selecting courses, the administrator can also use a checkbox to make courses required.

June 2, 2020​

Bulk Actions for eLearning Administrators​
  • Veracode eLearning administrators can now apply actions, including assigning learners to tracks or curricula and enabling automatic track extensions, to multiple users at once. This enhancement simplifies the process of onboarding and managing eLearning users.
]]> <![CDATA[Package Firewall updates]]> https://docs.veracode.com/updates/r/Package_firewall_updates 2026-07-07T00:00:00.000Z The updates on this page apply to Package Firewall. Subscribe to the Package Firewall updates RSS feed Feed-icon.png.

Updates that apply to specific Veracode regions show a region icon.

July 7, 2026​

Package Firewall is now available in the European region ​

Veracode Package Firewall is now available in the European region.

November 18, 2025​

Package Firewall​

Veracode Package Firewall is now available. Use it to automatically block untrusted packages that don’t comply with your policies across artifact repositories and package managers. It mitigates risks from malware, typosquatting, and license violations by ensuring that only verified and compliant dependencies are used.

]]> <![CDATA[Platform updates]]> https://docs.veracode.com/updates/r/c_all_platform 2026-09-24T00:00:00.000Z Updates on this page apply to the Veracode Platform. Subscribe to the Platform updates RSS feed Feed-icon.png.

Updates specific to certain regions are marked with a region icon.

September 24, 2026​

The IDE and CLI Usage Explore and Dashboard are now available in the European Region ​

The IDE and CLI Usage Explore and Dashboard are now available in the European Region. For more information, see Pre-built Analytics Dashboards and IDE and CLI Usage Explore data dictionary.

To stay up to date when error codes and error messages become available in Analytics, follow Integration updates.

September 8, 2026​

New Veracode Dashboard and Analytics Explore: IDE and CLI Usage ​

Veracode Analytics introduces the IDE and CLI Usage Explore and Dashboard to visualize and explore your organization's IDE and CLI usage. For more information, see Pre-built Analytics Dashboards and IDE and CLI Usage explore data dictionary.

Note that events from the following IDE plugin versions display null error codes and messages:

  • VS Code v1.16.2 and earlier
  • Visual Studio v0.8.1 and earlier
  • JetBrains v1.8.0 and earlier

To stay up to date when error codes and error messages become available in Analytics, follow Integration updates.

July 29, 2026​

New Custom PDF REST API ​

You can now use the new Custom PDF REST API to programmatically generate custom PDF reports.
For more information, see Custom PDF REST API.

July 15, 2026​

XML APIs now support OAuth Client Credentials​

You can now use OAuth Client Credentials to authenticate with the Veracode XML APIs, in addition to the REST APIs.

July 13, 2026​

Firewall Analytics performance improvements​

Veracode Analytics improved query performance in Firewall Explore. Success events were also removed from the Firewall dataset.

July 6, 2026​

Healthcheck endpoint removed​

We removed the Veracode Healthcheck endpoint /healthcheck/status, and it now returns a 404 error.

To check the status of authenticated connectivity to Veracode, use the v2/principal endpoint in the Identity REST API.

June 30, 2026​

Updates to security standards​

The Auto-Update OWASP rule and the Auto-Update CWE Top 25 rule for application security policies now enforce the OWASP Top 10:2025 and MITRE CWE Top 25 for 2025 standards. For more details, see CWEs that violate security standards.

New built-in security policies​

We added six new built-in policies to the Veracode Platform as part of the plan to deprecate the recommended and transitional policies next year. For more details, see Built-in security policies.

May 27, 2026​

Upgrade to Looker 26.6​

Veracode upgraded Veracode Analytics to Looker version 26.6 in the European and Commercial regions. Looker 26.6 provides an improved dashboard experience that includes finer granularity in widget sizes, persistent filtering, and tabbed dashboards.

This upgrade is scheduled for June 17, 2026, in the United States Federal region.

May 26, 2026​

New collections_list field to the Finding Reporting API​

The Finding Reporting API now includes the collections_list field in responses. This field returns a list of collection names associated with the application. For details, see the Reporting REST API documentation and Reporting API Swagger documentation.

May 20, 2026​

Veracode Analytics adds Collections fields to the Applications explore​

Veracode Analytics now includes Collections fields in the Applications explore. The Policy Compliance Overview dashboard now includes new visualizations for Collections. For more details, see Applications data dictionary.

May 18, 2026​

New most_recent_scan filter available for the Reporting API Scans report​

The Reporting API Scans report now supports the most_recent_scan filter. When set to true, the API returns only the most recent scan per asset. This reduces the need for client-side filtering and post-processing. For details, see the Reporting REST API documentation and Reporting API Swagger documentation.

May 7, 2026​

Healthcheck endpoint deprecated​

The Veracode Healthcheck endpoint /healthcheck/status is deprecated, and will be removed on July 6, 2026. If you use this API after this date, you will encounter errors.

To check the status of authenticated connectivity to Veracode, use the v2/principal endpoint in the Identity REST API.

April 30, 2026​

Support for OAuth 2.0 Client credentials on the API Credentials page​

You can now create and manage Veracode API credentials using OAuth 2.0 Client credentials on the API Credentials page in the Veracode Platform. Veracode integrations and APIs can use these credentials to authenticate with Veracode.

April 8, 2026​

New Veracode Analytics Explore and Veracode Dashboard: Firewall Usage ​

Metrics for Veracode Firewall are now available in Veracode Analytics! For more information, see the documentation on the Firewall Usage Dashboard and Firewall Usage Explore. To learn more about Firewall, see the Firewall documentation.

March 3, 2026​

New look for the Veracode Policy Settings page ​

The Policy Settings page in the Veracode Platform now supports light and dark mode.

March 2, 2026​

New field added to the Veracode Reporting API findings response​

The new library_instance_ref field has been added to the Veracode Reporting API findings response. This field uniquely identifies the specific library instance associated with a finding. See the Reporting REST API documentation and Reporting API Swagger documentation for details.

February 10, 2026​

Upgrade to Looker 26.0​

Veracode has upgraded Veracode Analytics to use Looker version 26.0 in the European and Commercial regions. This upgrade occurs on February 18, 2026 for the United States Federal region.

February 3, 2026​

New look for the Veracode Policy Settings page ​

The Policy Settings page in the Veracode Platform now supports light and dark mode.

January 20, 2026​

New custom_severity filter available for the Reporting API Findings report​

The Reporting API Findings report now supports the custom_severity filter. See the Reporting REST API documentation and Reporting API Swagger documentation for details.

December 19, 2025​

Updates to Reporting API metadata and Swagger documentation​

A new field, data_refresh_date, has been added to the Reporting API to indicate the most recent time Analytics data was refreshed.

The Reporting API Swagger documentation has also been updated to reflect that Reporting API datetime filtering uses UTC.

December 18, 2025​

New look for the Veracode Policy Settings page ​

The Policy Settings page in the Veracode Platform, now supports light and dark mode.

Support added for OAuth 2.0 client credentials flow ​

You can now generate OAuth 2.0 client credentials for Veracode integrations and APIs. See the updated Veracode Identity API for additional information.

October 27, 2025​

New look for Veracode Platform pages ​

The following pages in the Veracode Platform now have an updated UI and support for both light and dark mode themes:

  • All Applications
  • Add New Application
  • Edit Application

This update is currently available to a limited set of users in the Commercial region.

September 8, 2025​

Veracode Analytics data refresh improvements ​

In Veracode Analytics, the data refresh time has decreased from four hours to two hours. To better capture this improved refresh rate, Analytics has also moved away from a set refresh schedule. See About Analytics data refresh times for additional information.

September 2, 2025​

Manual Penetration Testing Flaw Matching​

MPT Flaw Matching is a new feature that correlates findings across tests to provide consistent flaw IDs, status values, and the ability to include MPT findings in remediation grace periods for security policies. See the Veracode Docs.

August 13, 2025​

New learning path for security policies​

Learn about Veracode security policies and how they can help your organization enforce a uniform application security policy across your applications. See the learning path Veracode security policies.

July 8, 2025​

Disable Veracode-defined roles for users with custom roles​

For users who use custom roles, you can now disable Veracode-defined roles. This gives you more control over user access and permissions within your organization. For more information, see the Veracode documentation and the updated Identity API specification on SwaggerHub.

June 25, 2025​

Change to last_updated_date in Reporting REST API Scans object​

The last_updated_date field in the Reporting REST API Scans object has been updated to take into account modifications done to scans. This change will now include updates to scan names after they have been published. For additional information about last_updated_date in the Reporting API, see Veracode Documentation.

May 29, 2025​

Containers & IaC scan results available on Veracode Platform​

Results of container and IaC scans, performed from the CLI, are now available on the Veracode Platform.

This update includes the following capabilities:

  • Displays the results of container and IaC scans, performed from the CLI, on the Veracode Platform.
  • Provides the severity count of scan findings, categorized as critical, high, medium, and low.
  • Allows you to filter and search findings.
  • Presents scan history for each asset to help you track changes in findings reported.
  • Provides mitigation guidance, such as finding description and suggested fix.

May 27, 2025​

New action_type filter in the Audit Log report available for the Reporting API commercial-icon.png​

This new filter in the Reporting REST API allows you to retrieve audit log records based on specific user actions, making it easier to narrow down and analyze relevant activities. For more details, see the Reporting API specification on SwaggerHub.

May 6, 2025​

New Audit log report available for the Reporting API commercial-icon.png​

The Reporting REST API now supports generating an Audit Log report. This new report allows you to query Veracode Analytics for detailed information related to user activity. For more details, see the Reporting API specification on SwaggerHub.

April 8, 2025​

Fix Usage Veracode dashboard now available in European Region ​

The Fix Usage Veracode Analytics dashboard is now available in the European Region. The Fix Usage dashboard enables users to understand how and which developers are using Veracode Fix within their organization. For more details about Veracode Dashboards, see the Veracode documentation.

March 24, 2025​

Map multiple domains to a single identity provider ​

If you've configured single sign-on (SSO) to use service provider (SP)-initiated Security Assertion Markup Language (SAML), you can now map multiple domains to a single identity provider (IdP) for an organization. For more information, see Service provider-initiated SAML authentication.

March 7, 2025​

Reporting REST API now available in European Region ​

The Reporting REST API is now available in the European Region as part of our Early Access (EA) program. To access this API, submit a request to Veracode Technical Support by emailing support@veracode.com. For more details about the Reporting API, see the Veracode documentation.

March 6, 2025​

Customizable PDF displays SCA Component License Risk policy compliance​

The Customizable PDF takes into account policy rules for SCA Component License Risk. The components' license risk policy compliance status will now be displayed in the Executive Summary and Detailed SCA Findings by Component sections of the report.

February 19, 2025​

Upgrade to Looker 24.18 ​

Veracode has upgraded Veracode Analytics to use Looker version 24.18 in the United States Federal region.

SCA Component Blocklist rule removed from built-in policies ​

Veracode has removed the SCA Component Blocklist rule from the built-in Veracode Recommended policies in the United States Federal Region instance. This change does not impact policy compliance for existing applications. For more details, see the Product Announcement on the Veracode Community.

February 18, 2025​

New look for Veracode Platform pages ​

The following pages in the Veracode Platform have an updated look and feel, and support light and dark mode based on your selected theme.

  • Platform Home
  • Your Account Settings
  • API Credentials
  • Notification Settings

These updated pages and theme settings are currently available to a limited set of users in the Commercial region. Veracode is gradually updating more pages and will make them available in other regions in future updates.

February 12, 2025​

Customize columns in the All Users table ​

Administrators can now select the Set Columns button to customize the All Users table on the Administration page.

February 7, 2025​

Customer Managed Encryption Keys ​

Veracode Customer Managed Encryption Keys (CMEK) allows you to encrypt your data in Veracode Platform using your own root encryption key. With CMEK you can:

  • Control encryption and access to your data
  • Manage your root encryption key in your KMS
  • Configure Veracode application profiles to use your root encryption key
  • Periodically rotate your root encryption key

This feature is available for both new and existing application profiles.

February 5, 2025​

SCA Component Blocklist rule removed from built-in policies ​

Veracode has removed the SCA Component Blocklist rule from the built-in Veracode Recommended policies in the European Region instance. This change does not impact policy compliance for existing applications. For more details, see the Product Announcement on the Veracode Community.

January 30, 2025​

SCA Component Blocklist rule removed from built-in policies ​

Veracode has removed the SCA Component Blocklist rule from the built-in Veracode Recommended policies in the Commercial Region instance. This change does not impact policy compliance for existing applications. For more details, see the Product Announcement on the Veracode Community.

January 28, 2025​

Reporting REST API v1.4 ​

Veracode has released Reporting REST API version 1.4. This update adds support for filtering Findings and Scans reports using development sandbox IDs. The API specification is available on SwaggerHub.

January 23, 2025​

Upgrade to Looker 24.18 ​

Veracode has upgraded Veracode Analytics to use version 24.18 of the Looker platform in the Commercial and European regions.

January 6, 2025​

Longer passwords required ​

Veracode has changed the minimum length for passwords from 8 characters to 10. For existing users, this change will take effect the next time you change your password.

December 16, 2024​

United States Federal region status page ​

You can now get status about planned maintenance events and incidents, and subscribe to notifications for the United States Federal region at the new United States Federal region status page, available at https://status.veracode.us.

November 22, 2024​

Updated SCA Findings dashboard ​

The SCA Findings dashboard includes the following improvements:

  • Libraries with Vulnerable Methods: The Library Issues Count measure is now called Libraries Count to provide a more accurate representation of impacted libraries.
  • How Risky Are My Licenses?: The Vulnerability Count measure is now called Issue Count to improve consistency with other metrics.

November 22, 2024​

PCI 4.0 support ​

The Veracode PCI Report now supports the latest version of the PCI standard.

October 9, 2024​

Custom roles for user accounts and API service accounts ​

You can now create, edit, and manage unique, tailored roles for more precise control over user access and permissions in your organization. With custom roles, you can:

For more details, see the Veracode documentation and the updated Identity API specification on SwaggerHub.

September 30, 2024​

New Scans report available for the Reporting API commercial-icon.png​

The Reporting REST API can now generate a Scans report. Similar to the existing Findings report, you can query Veracode Analytics for information about Static Analysis, linked Dynamic Analysis, and Manual Penetration Testing scans.

For more details, see the Reporting API specification on SwaggerHub.

September 13, 2024​

New status and maintenance REST API endpoint​

The REST API endpoint for checking the current status and upcoming maintenance schedule for Veracode services has changed from https://api.status.veracode.com/status to https://status.veracode.com/api/v2/summary.json. Veracode recommends you move any automation to the new endpoint as soon as possible.

The previous endpoint will be retired on October 31, 2024.

September 9, 2024​

The Manual Testing API has been migrated to the Findings API​

Veracode has moved all functionality of the Manual Testing REST API to the Findings REST API. All endpoint signatures and response objects remain the same. However, the following input parameters have been updated:

  • The scan GUID parameter for getScan has been replaced with integer scanId. scanId is found in the getScans response.
  • The scan GUID parameter for getFindings has been replaced with integer scanId. scanId is found in the getScan response.
  • The finding GUID parameter for getFinding has been replaced with integer findings[].id. findings[].id is found in the getFindings response.

The Findings API specification is available on SwaggerHub for more details.

August 13, 2024​

Upgrade to Looker 24.6​

Veracode has upgraded Analytics to use version 24.6 of the Looker platform in the Commercial and European regions.

June 20, 2024​

Project scan IDs added to Reporting API​

Added the following fields to the Findings report of the Reporting API for findings from agent-based scans that are linked to applications:

  • original_project_scan_id: The original project scan in which an SCA agent identified the application-linked finding.
  • latest_project_scan_id: The most recent project scan in which an SCA agent identified the application-linked finding.

Changes to dates for application-linked SCA agent findings in Analytics​

Veracode Analytics and the Reporting API have updated how they determine the values for date fields of agent-based scan findings that are linked to applications. The following fields now retrieve data from the agent-based scanning history instead of the SCA upload scan history:

  • First Found Date
  • First Found in Application Date
  • Library First Found in Active Scans Date
  • Last Found Date
  • Reopened Date
  • Fixed Date

This update impacts the following fields because they derive data from the updated fields listed above:

  • Resolved Date
  • Grace Period Expiration Date
  • Flaw Age

May 6, 2024​

New columns in SCA License Risk Data Export report​

The SCA License Risk Data Export report now includes the following columns:

  • Business Unit for applications associated with SCA upload scans
  • Project Name for SCA agent-based scanning projects
  • Library Version for libraries found in SCA agent-based scans
  • Last Scanned Date and SPDX ID for libraries found in SCA agent-based scans or upload scans

April 28, 2024​

Upgrade to Looker 24.0​

Veracode has upgraded Analytics to use version 24.0 of the Looker platform. Key updates include:

  • AND/OR filtering
  • Performant field picker
  • Quick resize and tile repositioning

The complete list of changes is available in the Looker documentation.

April 10, 2024​

Add a Git repository to application metadata ​

You can now add the URL of a Git repository to the application profile metadata using the Applications REST API and the Veracode Platform.

April 4, 2024​

Veracode Analytics updates​

The Veracode Analytics Findings explore includes the following improvements:

  • Updated the Policy Rule Passed (Yes / No) field to match the new policy logic changes to findings from a Software Compsition Analysis (SCA). If SCA findings violate policy, but are within the grace period, the Veracode Platform does not report them as not passing policy, or "No".
  • Added a new Findings Policy Status field that you can use to tag findings that violate policy and are within grace period as Conditional Pass.
  • The SCA Agent-Based Scan Issues page now provides data about the projects and workspaces that generated the issues.

April 3, 2024​

The Veracode Documentation has the following improvements:

  • New Learning paths provide a sequence of videos and documentation that walk you through using Veracode products. For example, the steps show you how to prepare applications for scanning, run a Static Analysis or Dynamic Analysis in the Veracode Platform, and then review the results. By following these paths, new users can onboard and experienced users can gain a deeper understanding of Veracode products, features, and best practices.
  • New search experience that helps you more easily search across all documentation and filter the results.

March 26, 2024​

Add Git repository to application metadata​

You can now specify the URL of a Git repository in the application profile metadata using the Applications REST API and the Veracode Platform.

Previous updates​

2023 updates​

2023 updates

November 27, 2023​

Free trial of DAST Essentials​

Veracode now offers a free 14-day trial of DAST Essentials in the Veracode Platform. To sign up, on the Sign in page, select Sign Up to create your account. If you are a Veracode customer and want to try DAST Essentials, contact your sales associate.

November 27, 2023​

Free trial of DAST Essentials ​

Veracode now offers a free 14-day trial of DAST Essentials in the Veracode Platform. To sign up, on the Sign in page, select Sign Up to create your account. If you are a Veracode customer and want to try DAST Essentials, contact your sales associate.

October 17, 2023​

New Veracode Analytics fields available​

The new Second Party Component and Fixable (Yes / No) fields in the Veracode Analytics Findings explore are now available.

October 16, 2023​

New Veracode Analytics fields available in European Region ​

The new Second Party Component and Fixable (Yes / No) fields in the Veracode Analytics Findings explore are now available in the European Region.

September 29, 2022​

New Application Security Platform features available in European Region ​

The following features are now available in the European Region.

July 19, 2023​

Upgrade to Looker 22.20​

Veracode has upgraded Analytics to use version 22.20 of the Looker platform. All existing dashboards now reflect the new Looker experience.

This upgrade introduces a known issue that prevents you from scrolling in the Timeline visualization. Additionally, you may experience an issue that automatically enables the Row Totals column in some pivot tables, which can cause rows to be double counted in stacked visualizations. To fix this issue, edit the dashboard and visualization, clear the Row Totals option, and save your changes.

Updated Security Program Overview Dashboard​

The default number of applications displayed in the What is my policy compliance over time? section of the Security Program Overview dashboard in Veracode Analytics has decreased from 100 to 25.

To view additional applications, customize the visualization and adjust the Application Rank by Published Date Descending filter.

2022 updates​

2022 updates

July 15, 2022​

CWE Top 25 Now Reflects 2022 Version​

The Auto-Update CWE Top 25 security standard that you use in Veracode policies now reflects the 2022 CWE Top 25 list.

June 28, 2022​

Updated Single Sign-On and Just-In-Time Provisioning​

New single sign-on (SSO) and Just-In-Time (JIT) provisioning capabilities in the Veracode Platform improve reliability and supportability and extend the roles that JIT provisioning supports. Before using this feature, you must update your SSO settings in your identity provider.

To begin the process of enabling these capabilities, contact Veracode Support.

May 19, 2022​

The Issues Vulnerability Count Measure Changed​

Issues Vulnerability Count now includes only issues where the Issue Type is a Vulnerability Issue. In the past, this measure included the count of Vulnerability, License, and Library issues. The calculation of Issues Vulnerability Count is still based on the filters you select.

  • Issues Issue Count: count of issues, regardless of type
  • Issues Vulnerability Count: count of vulnerability issues
  • Issues Libraries with Issues: total number of unique libraries with at least one issue

May 10, 2022​

Sandbox Information Available in Unsubmitted Static Scans Data Export​

Veracode has added sandbox information to the Unsubmitted Static Scans data export to make it easier to find the incomplete static scans for an application.

SCA dashboards available in Analytics ​

Data from Veracode Software Composition Analysis (SCA) agent-based scans and upload scans is now available in Veracode Analytics for the European Region. The predefined Veracode dashboards, including the SCA Findings dashboard, now contain SCA scan data. You can also use the Findings, SCA Agent-Based Scans, and SCA Agent-Based Scan Issues data explores for custom reporting.

May 6, 2022​

End of Support for Internet Explorer 11​

Veracode will no longer support Microsoft Internet Explorer 11 after June 30, 2022. This change follows the Microsoft updates to its support model for Internet Explorer. Veracode recommends that you switch to a supported browser to avoid issues.

Official Support for Microsoft Edge​

The Veracode Docs are updated to confirm that Microsoft Edge is a supported browser.

May 3, 2022​

Support cases and scheduled consultations now available ​

You can now raise a support case and schedule a consultation from the Veracode Platform in the European Region.

Veracode Platform services updated to current versions ​

Applications and policies for the European Region now run on the current versions in the Veracode Platform.

April 4, 2022​

Improved Team Management in the Veracode Platform​

Veracode has improved the usability of the team management options on the Administration page in the Veracode Platform.

March 22, 2022​

View Applications by Policy Evaluation Date​

You can now view the date and time of the most recent event that triggered a policy evaluation for an application in a new field in the Applications REST API and the Applications list in the Veracode Platform. You can use this field to search for applications that have had new scans or approved mitigations since the listed date.

2021 updates​

2021 updates

December 9, 2021​

OWASP Top 10 2021​
  • The Auto-Update OWASP requirement available for application security policies now reflects the 2021 version of the OWASP Top 10.

November 5, 2021​

New Veracode Documentation URL​
Deprecation of Veracode Documentation PDFs​
  • Veracode has deprecated the PDF files of publications available on the Veracode Documentation website. By December 2021, you will no longer be able to download these PDFs, but you can create custom PDFs using the print feature in your browser. To create a custom PDF, click Print (printer icon) in a publication title bar or to the right of a topic title, select the topics to include or exclude, then click Print.

September 28, 2021​

API Rate Limit Enforcement​
  • Veracode is now enforcing API rate limiting to ensure optimal performance and availability of Veracode services.

September 15, 2021​

Updated Subprocessor List​
  • Veracode has updated the list of subprocessors used to process customer personal information.

August 31, 2021​

2021 CWE Top 25 Support​
  • The Auto-Update CWE Top 25 policy rule in Veracode security policies now reflects the 2021 CWE Top 25 standard. In a future release, Veracode will add the option to specifically select the 2021 CWE Top 25 standard in policy rules.
CWE 4.5 Support​
  • Veracode CWE support now reflects the changes MITRE introduced in version 4.5 of the CWE list.

August 12, 2021​

Updated Video - Create a Policy in the Veracode Platform​
  • This video shows you how to create a custom policy in the Veracode Platform.

July 20, 2021​

Improved Veracode Onboarding Experience​
  • Veracode has improved the onboarding experience to help developers and application security managers get started with Veracode. In the Veracode Platform, select Resource Center > Getting Started to open the new Getting Started with Veracode guidance, which provides a walk-through of Veracode products and training offerings.

July 8, 2021​

Updated Video - Create a New Application Profile in the Veracode Platform​
  • This video shows you how to create a new application profile in the Veracode Platform.

June 29, 2021​

Improved Veracode Platform Homepage​
  • The homepage in the Veracode Platform is updated to make it easier to perform several common functions, such as generating API credentials.

May 25, 2021​

Automatically Update to Latest Version of Security Standards in Policy Rules​
  • You can set rules in your application security policies that automatically update to use the most recent version of the supported security standards. With this update, you can require applications to comply with the latest version of security standards, such as OWASP Top 10 or CERT, as soon as Veracode supports them.
2020 CWE Top 25 Standard Available in Policy Rules​
  • Veracode now supports using the 2020 version of the CWE Top 25 standard as a requirement in application security policies.
PCI Standard Includes 2020 CWE Top 25 Most Dangerous Software Weaknesses​
  • A new version of the PCI security standard, which includes the 2020 CWE Top 25 most dangerous software weaknesses, is now available as a requirement in application security policies.
PCI Report Now Evaluated Against the Auto-Update PCI Standard​
  • The PCI report available from the Veracode Platform is now evaluated against the Auto-Update version of the PCI security standard. This update ensures that the report always uses the latest version of the PCI standard.

April 8, 2021​

Access the Veracode Community from the Veracode Platform​
  • You can now access the Veracode Community directly from the Veracode Platform without logging in to a separate Community account. The Veracode Community provides best practice documentation, new feature previews, and a forum for asking questions about how to most effectively use Veracode products and services.

April 7, 2021​

Evaluation Timeframe for Security Policies​

You can now include evaluation timeframes in Veracode application security policies to define when findings can impact policy compliance. In your policies, you can:

  • Disallow findings opened after a specific date to ignore technical debt.
  • Disallow findings opened before a specific date to ignore new findings that are out of scope for an audit requirement.

April 6, 2021​

End of Browser Support for Legacy Versions of Safari and Android​

Veracode no longer supports these legacy versions of Safari and Android because of their use of weak ciphers (TLS 1.2):

  • Safari 6 on iOS 6.0.1

  • Safari 7 on iOS 7.1

  • Safari 8 on iOS 8.4

  • Safari 7 on OS X 10.9

  • Safari 8 on OS X 10.10

  • Android 5.0.0

  • Android 6.0

You cannot access analysiscenter.veracode.com using these browsers.

Administrators Cannot Assign Applications to Teams​
  • Administrators in the Veracode Platform can no longer assign applications to teams unless they have another role that grants them permission to edit application profiles. Veracode removed this rarely used functionality to provide a more consistent experience for users.
Allow Access to New URL for Penetration Testing Services​
  • Veracode has introduced a new URL for a future feature that will support better reporting of our penetration testing services. If you restrict access to public internet sites for your organization, add pt.analysiscenter.veracode.com to your allowlist.

March 31, 2021​

Changes to Email Addresses Require Verification​
  • If you update the email address in your Veracode Platform user account, Veracode sends you an email to confirm the new address. You must confirm the email address to complete the update.

March 26, 2021​

New Analytics Dimension for Findings and Scans​
  • Veracode Analytics provides you with the ability to filter findings and scans based on their archive status. You can use these filters to easily find findings and scans that Veracode deleted as part of the sandbox scan retention process.

March 22, 2021​

Improved User Management in The Veracode Platform​
  • Veracode has improved the usability of the user management options in the Veracode Platform. Administrators and Team Admins can now search for users by name, email address, username, or API ID.

March 9, 2021​

Veracode Analytics Updates to the SCA Findings Dashboard​
  • Veracode has updated the SCA Findings dashboard to improve the visualization of data and provide more information on how fixing code libraries impacts findings.

February 9, 2021​

New Static Analysis Findings Information in Veracode Analytics​
  • Veracode Analytics now provides more details about findings that relate to your Static Analysis scans, including the function name, class path, and most recent line number in which Veracode discovers the findings. This data enables you to recreate a similar view as the Triage Flaw view in the Veracode Platform, but across multiple application profiles.

February 8, 2021​

New Security Program Overview Dashboard in Veracode Analytics​
  • Veracode Analytics provides a new dashboard that contains data to help you track and understand how your AppSec program is trending, based on your target goals. With this dashboard, you can see current and historical trends for policy compliance, as well as better understand policy compliance behavior. New information available to you includes details such as how an application is meeting compliance over time.

January 26, 2021​

Improved User Interface for Managing Applications​
  • Veracode has updated the user interface in the Veracode Platform for creating, viewing, updating, and deleting applications to improve usability.

January 19, 2021​

Improved Email Notifications for Expiring API Credentials​
  • Veracode sends an email notification when your Veracode API credentials are about to expire. The email now displays your API username for quickly identifying the account for which you need to generate new credentials.

2020 updates​

2020 updates

December 7, 2020​

Additional SCA Details Available from the Findings REST API​
  • With the Veracode Findings REST API, you can identify whether Software Composition Analysis findings are from agent-based scans or upload scans and whether they are from a direct or transitive dependency. You can also filter your findings by scan type or dependency type.

November 23, 2020​

Updates to the Findings REST API​

You can now perform these tasks with the Veracode Findings REST API:

  • Retrieve the expiration date of the remediation grace period for findings that violate a security policy.
  • Retrieve findings with comments or mitigations added after a specific date, such as the date of your most recent scan.
Healthcheck REST API​
  • You can use the Veracode Healthcheck REST API to test the availability of Veracode core services.

October 29, 2020​

Changes to OWASP Mobile Policy Rules​

  • Veracode has updated policy rules that include the OWASP Mobile security standard to reflect additional research. OWASP Mobile policy rules now include these CWEs: CWE-77, 78, 80, 252, 287, 319, 345, 404, 415, 416, 601, 614, 676, 693, 757.

  • Applications that contain these flaws may fail OWASP Mobile policy rules as a result of this update. Veracode will apply the update upon rescan of the application.

Improved Notifications for Delayed Scan Results​
  • Veracode has improved communication about delayed scan results. You now receive email notifications that include additional details and links for the affected scan. Veracode has also improved the Veracode Platform to indicate delayed scans that are under investigation.

October 19, 2020​

Applications REST API​
  • You can now view application data and create, update, and delete applications using the Veracode Applications REST API.

September 30, 2020​

Updates to Required Veracode Domains​

September 26, 2020​

Rolling Sandbox Histories​

  • Rolling sandbox histories let you limit sandbox data by restricting the number of retained scans for each sandbox to 15. After more than 15 scans, the Veracode Platform deletes the oldest scan, though the data remains available through Veracode Analytics. If enabled, this feature replaces the previous data limitation method of expiring old sandboxes.

  • To request access to rolling sandbox histories, contact Veracode Technical Support.

Updates to Some XML API Deletion Calls​
  • To improve performance, the deleteuser.do, deleteteam.do, deleteapp.do, and removefiles.do XML API calls now return an HTTP 200 response and a change summary, instead of a list of the items remaining after the deletion.
  • You can now share links to Veracode Analytics dashboards, including Veracode dashboards and dashboards that your organization creates. To access a dashboard link, you must log in to the Veracode Platform and have permission to view the data in the dashboard.
Activity Log Updates​
  • You can now download a report of the full history of application profile activity, scan activity, and sandbox activity. The activity log in the Veracode Platform now displays activity data for the past 90 days.
Technique Removed from TSRV Format for Accepting Risk​
  • Veracode has removed Technique from the TSRV standard when you perform the Accept the Risk mitigation action because none of the techniques are relevant to accepting risk. Specifics, Remaining Risk, and Verification are still required fields.
Updates to CWE Top 25 Policy Rules​
  • The Latest CWE Top 25 policy rule in the Veracode Platform now reflects the 2020 CWE Top 25 standard. Veracode has also updated the 2019 CWE Top 25 policy rule to disallow the children of CWE-94: CWE-91, 95, 98, 185, and 830.

September 17, 2020​

Improved Business Units Tab​
  • On the Administration page in the Veracode Platform, Veracode has improved the usability of the Business Units tab.

September 10, 2020​

New Video - Create and Manage API Users in the Veracode Platform​

August 29, 2020​

All Applications Page Now Available to Mitigation Approver and Delete Scans Roles​
  • You can now access the All Applications page in the Veracode Platform with the Mitigation Approver or Delete Scans roles. From the All Applications page, you can, then, select an application to approve mitigations or delete scans.
CWE-74 Now Disallowed for the OWASP Security Standard​
  • Veracode has reclassified CWE-74 "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')" as a high severity finding. CWE-74, which Veracode discovers during Dynamic Analysis, is now included on the disallowed CWE IDs list in the latest version of the OWASP security standard. If your organization is using the OWASP 2017 security standard, you may see more findings violating policy or see your application fail policy as a result of this change.
Support for MITRE CWE List Version 4.1​

  • Veracode now provides reporting based on CWE version 4.1 definitions, which changes the names and descriptions of a few existing CWE categories. The complete list of changes in CWE version 4.1 is available from the MITRE website. This new version does not impact the CWE mappings for the OWASP, CWE Top 25, or CERT security standards.

  • MITRE is updating their CWE list on a more frequent basis, but Veracode remains committed to staying up-to-date with each new version. As MITRE updates their CWE database, you might notice periodic changes in Veracode reports, such as differences between parent-child relationships or mappings.

August 21, 2020​

Findings API Version 2​
  • The Veracode Findings REST API v2 is now available. With this API, you can access information about open and mitigated findings associated with applications and sandboxes. It supports Static Analysis, Dynamic Analysis, Manual Penetration Testing, and Software Composition Analysis scans.

July 28, 2020​

Improved User Activity Report​
  • An improved user activity report is now available to download as a CSV file, providing easier access to information about user actions.

July 7, 2020​

Administrators Can Turn Off Optional Notifications for Their Entire Organization​
  • Administrators in the Veracode Platform can now turn off all optional notifications for all new and existing users in their organization account. Individual users have the option to turn the notifications back on for their own user account.

June 29, 2020​

New Accept the Risk Mitigation Type​
  • Veracode now allows you to resolve a finding by stating that your business is willing to accept the risk associated with that finding. This mitigation type allows you to track and report the risk while continuing to maintain the mitigation and resolution approval process. Veracode updated the mitigationinfo.xsd file to include this mitigation type.

June 27, 2020​

Veracode Policies Now Support 2019 CWE Top 25 Security Standard​
  • Veracode updated the PCI security standard in the Veracode Platform to include the 2019 CWE Top 25 Security Standard, previously called the SANS Top 25 standard. Applications with findings included in the new standard may fail the PCI policy or PCI standard requirement as a result. Veracode applies the update to applications upon rescan.

June 16, 2020​

Veracode Analytics Provides Ignored Issue SCA Data​
  • Veracode Analytics now supports SCA agent-based scan issue data about ignored issues, including details of when a user ignored an issue and the username for the user who ignored the issue.

June 11, 2020​

New Sandbox Attributes Added to Veracode Analytics​
  • Veracode Analytics now provides attributes for tracking sandbox usage. You can view sandbox expiration dates and determine if the Veracode Platform sandboxes are configured for Veracode to automatically recreate them after expiration.
New Dynamic Analysis Dimensions Available in Veracode Analytics​
  • Veracode Analytics now provides the Dynamic Analysis fields Path and Vulnerable Parameter, which allow you to better focus and prioritize your remediation efforts.

June 8, 2020​

SCA Agent Data Available in Veracode Analytics​
  • The Software Composition Analysis (SCA) dashboard is updated in Veracode Analytics to reflect recommended charts for tracking your use of SCA agent-based and upload-and-scan workflows. In addition, Veracode Analytics provides two new explores for SCA agent data: SCA Agent Issues and SCA Agent Scans. These explores enable you to create your own charts and dashboards, providing a better understanding of your open-source risk.

May 28, 2020​

Update to Industry Values in Application Profile​

  • Veracode has updated the values for industries in application profiles to more accurately reflect the market. Because applications include industry values to help inform the Veracode State of Software Security report, this change affects the createapp.do and updateapp.do XML API calls.

  • If you have a script coded with an expected value for the industry field, please update your script to reflect the updated values or use the default value already provided.

May 13, 2020​

Analytics Scan Frequency Requirements Data​
  • Veracode Analytics now provides visibility into scan frequency requirements for an application. These requirements include the frequency mandated by the policy, upcoming scan due dates, and any past due dates.

May 7, 2020​

New Team Admin Role​
  • Veracode has added the new Team Admin user role that an administrator can grant to users. With the Team Admin role, you can create, edit, and delete users within the teams you manage. This new role makes it easier for organizations to manage permissions for a large number of users.
New Mitigation Type​
  • Veracode has added a new mitigation type to allow you to propose mitigations using the mitigation type Mitigated - Referred to Library Maintainer. You can classify findings related to libraries developed by another development team. Another development team may build libraries in-house, but they may not own the application Veracode is scanning.

April 30, 2020​

New Identity REST APIs​
  • The new Identity REST APIs allow you to manage users, teams, and business units. You can also use these REST APIs to create API service accounts and manage API ID/key credentials.
Updated Greenlight Scans Explore Page​
  • Veracode has updated the Analytics page Greenlight Scans Explore to reflect the new terminology of IDE scan (formerly known as Greenlight) and to include pipeline scan data.
Updated Applications List View​
  • The All Applications page in the Veracode Platform now provides customizable columns and improved searching and filtering. Veracode is gradually releasing this feature as part of each Platform release, so it may not be immediately available to you.
New Secure Coding Foundation eLearning Courses​

Veracode eLearning has released a new set of secure coding foundation courses:

  • Secure Coding Foundations - Authentication
  • Secure Coding Foundations - Authorization
  • Secure Coding Foundations - Configuration and Deployment
  • Secure Coding Foundations - Data Protection
  • Secure Coding Foundations - Information and Error Handling
  • Secure Coding Foundations - Trust Boundaries
  • Secure Coding Foundations - Validation and Encoding

These courses cover application security practices and associated vulnerabilities.

eLearning User Interface Enhancements​

Veracode has improved these eLearning windows:

  • Manager window you use to assign learners to a manager
  • Curriculum window you use to assign learners to a curriculum

April 21, 2020​

Updated Applications List View

  • The All Applications page in the Veracode Platform now provides customizable columns and improved searching and filtering.

March 28, 2020​

CWE 4.0 Support​
  • Veracode CWE support is updated to reflect the latest changes from MITRE in the CWE 4.0 release.
Enable Automatic Re-creation of Existing Sandboxes​
  • You can now edit existing sandboxes to enable the setting for automatically re-creating the sandbox when it expires.
Due Date Notifications for eLearning Students​
  • eLearning administrators can now specify when to send email reminders to notify students about the due dates for assigned courses.
New Python and JavaScript eLearning Courses​
  • Veracode has added secure coding courses for Python and JavaScript to eLearning learner levels.

March 19, 2020​

New Grace Period Expiration Date in Analytics​
  • Veracode Analytics now provides the date when a grace period expires. An expired grace period causes the finding to fail the policy associated with the application. Veracode calculates the date based on the First Found or Last Reopened date, whichever is more recent.
Account Lock Does Not Trigger Email to Administrator​
  • To prevent redundant notifications, Veracode no longer sends an email to Administrators in the Veracode Platform when users in their organization are locked out of their accounts. This email is now unnecessary because users can unlock their own accounts.

March 3, 2020​

Improved Developer Sandbox Scanning and Added Expiration Date​

Veracode has made these improvements to developer sandboxes:

  • You can now perform up to ten sandbox scans simultaneously for a single application. Before starting additional scans, you must wait for at least one running scan to complete.
  • The sandbox list in the application profile now shows all sandboxes in the application that have running scans.
  • All sandboxes now have an expiration date. After a sandbox reaches its expiration date, you can no longer perform scans in it. Seven days after the expiration date, the Veracode Platform automatically removes the sandbox. All data about the removed sandbox is available from Veracode Analytics. You can use the re-create option to have the Veracode Platform automatically create a new sandbox with the same name as a previously-removed sandbox.
Applications REST API Adds Policy Compliance Information​
  • Veracode has improved the Applications REST API to include information about the policy compliance of the application.
Executive Summary in Customizable Report PDF Includes Informational Findings​
  • The executive summary in the downloadable PDF of the Customizable Report now shows informational findings. The informational findings provide information that can help you ensure your application meets policy compliance.
Email Notifications for eLearning Curriculum Due Date Changes​
  • eLearning administrators can now send emails to notify students and their managers when the due date for an assigned curriculum changes. They can also send emails to notify managers when a due date on a curriculum has passed and students have not completed the curriculum.

February 21, 2020​

New JavaScript eLearning Courses​

Veracode eLearning has released a new set of secure coding courses for JavaScript:

  • Secure Coding for JavaScript - Authentication & Authorization
  • Secure Coding for JavaScript - Configuration and Deployment
  • Secure Coding for JavaScript - Data Protection
  • Secure Coding for JavaScript - Information and Error Handling
  • Secure Coding for JavaScript - Validation and Encoding

These courses cover application security practices and associated vulnerabilities, including the OWASP Top Ten, and secure coding techniques in JavaScript, including using the AngularJS and ReachJS frameworks.

February 19, 2020​

Updated Look-and-Feel with New Veracode Branding​
  • Veracode has updated the look-and-feel of the Veracode Platform with new branding.

January 28, 2020​

Updates to Sandbox Functionality​

Veracode has implemented these changes to improve the performance of sandbox scans:

  • You can delete a sandbox and all of its scans when you promote it to policy.
  • You may have a maximum number of sandboxes you can create for each application. The default limit is 25.
Automated Emails for eLearning Curriculum Updates​
  • Veracode eLearning administrators can turn on automated email notifications to alert eLearning students and managers when the administrator assigns a curriculum to a student.

January 24, 2020​

New Video - Create a Custom Policy in the Veracode Platform​
  • This video shows you how to create a custom policy in the Veracode Platform.

January 13, 2020​

SCA Findings Dashboard Available in Analytics​
  • Veracode Analytics has a new dashboard that provides Software Composition Analysis (SCA) findings on open vulnerabilities, license risk, issue severities, and library data. Veracode Analytics does not currently display findings from agent-based scans.

January 8, 2020​

New Video - Review Scan Results​
  • This video shows you how to view Veracode scan results in the Veracode Platform.

January 2, 2020​

SCA Findings Available in Veracode Analytics​

  • Veracode Analytics now provides details about Software Composition Analysis (SCA) findings. If you have an SCA subscription, you can view SCA vulnerabilities displayed in the Findings Status & History dashboard and the Resolution and Mitigation Details dashboard.

  • Veracode Analytics does not currently display findings from agent-based scans.

]]> <![CDATA[SCA updates]]> https://docs.veracode.com/updates/r/c_all_sca 2026-08-20T00:00:00.000Z The updates on this page apply to Veracode Software Composition Analysis (SCA). Subscribe to the SCA updates RSS feed Feed-icon.png.

Updates that apply to specific Veracode regions include a region icon.

August 20, 2026​

SCA agent release v3.8.120​

This update resolves minor issues that affected vulnerable method scans for JavaScript-based applications.

August 17, 2026​

SCA agent release v3.8.119​

This update improves the SCA agent's support for autopackaging .NET projects. Installing this update will not affect existing SCA agent-based scans.

July 24, 2026​

SCA agent release v3.8.118​

This update improves scan compatibility and reliability for Maven projects on Windows.

This update also improves error handling for Python-based scans when generating JSON reports. The SCA agent now handles errors more effectively, allowing reports to be generated successfully.

June 11, 2026​

SCA agent release v3.8.116​

We have enhanced support for .NET packaging workflows to improve scan compatibility and reliability. This update ensures consistent processing of .NET applications across supported packaging scenarios.

We have also updated dependency processing for NPM projects to reduce timeout conditions that can cause incomplete scan results. This update improves scan reliability for projects with large or complex dependency graphs.

April 23, 2026​

SCA agent release v3.8.115​

This update adds enhancements to the agent to support autopackaging, along with fixes and improvements for OpenWrt packaging. Installing this update will not affect existing SCA agent-based scans.

April 8, 2026​

SCA agent release v3.8.114​

This update adds support for autopackaging. Installing this update will not affect existing SCA agent-based scans.

March 31, 2026​

New SCA agent scan option to link results to an application profile ​

SCA agent release v3.8.113 adds the --appname flag to the SCA agent scan command for Commercial region users. The --appname flag links scan results to an application profile for improved visibility and management. It requires authentication with Veracode using OAuth or HMAC. For more information, see SCA agent commands.

Improved SCA agent scan output​

This update adds the --show-cli flag to the SCA agent scan command. Used with the --json flag, this option saves JSON output to a file and displays a human-readable CLI summary in the console. This option captures structured scan data for automation and maintains visibility of scan results in your terminal. The --show-cli flag requires the --json flag and returns an error if used without it. For more information, see SCA agent commands.

March 23, 2026​

Assign policies to SCA Agent-based Scan workspaces ​

Use the Unified Policy feature to assign policies to SCA workspaces in the US Federal region for SCA agent-based scans. Similar to existing workspace rules, you use policies to create issues and break builds based on defined criteria. For more information, learn about policy rules, assigning policies to SCA workspaces, and setting a default policy for SCA workspaces.

March 4, 2026​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements do not impact SCA agent-based scanning.

December 12, 2025​

Improved open source vulnerability data synchronization​

Veracode has enhanced the synchronization of open source vulnerability intelligence to ensure security scans reflect the most current risk information available. As part of this improvement, you may notice newly reported CVEs appearing in scan results even when there have been no changes to your application or dependencies. This outcome reflects up-to-date vulnerability data, and not any change in scan behaviour.

December 3, 2025​

SCA agent update​

Veracode has released minor updates to the SCA agent to improve support for autopackaging C/C++ projects, Node-based projects, and Make-based packaging workflows. These updates do not impact SCA agent-based scanning.

November 13, 2025​

Option to break builds only when a fix is available in SCA agent-based scans ​

Commercial region users can now configure the Vulnerability Severity rule in their policy to control when issues are created or when builds are broken based on the availability of an upgrade path to fix a vulnerable open-source component. For more information, see Security Policy Restraints.

SCA agent release v3.8.109​

Veracode SCA agent v3.8.109 resolves minor issues that affect SCA-agent SBOM scan capabilities.

July 30, 2025​

SCA agent update​

Veracode releases minor updates to the SCA agent to improve support for autopackaging C++/CX projects. These updates do not impact SCA agent-based scanning. Veracode also addresses the following issues:

  • Resolves packaging issues for C++/CLI and C++/CX projects.
  • Resolves several MSBuild errors that occur in C/C++ projects.

July 22, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements do not impact SCA agent-based scanning.

July 14, 2025​

Added support for Python 3.12 in SCA agent-based scans​

Veracode updated SCA agent-based scans to support Python 3.12 environments.

Assign policies to SCA agent-based scan workspaces ​

Use the Unified Policy feature to assign policies to workspaces in the European region for SCA agent-based scans. Similar to existing agent rules, policies help you create issues and break builds based on defined criteria. For more information, see applying rules to a policy, assigning policies to agent-based workspaces, and setting default policies.

June 30, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

June 3, 2025​

Generate SBOMs with SCA agent​

Veracode enhanced the SCA agent to support generating SBOM files during SCA agent-based scans.

May 28, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

May 22, 2025​

Fixed SCA agent CLI summary​

Veracode has fixed an issue that caused license vulnerabilities and associated library counts to display inaccurately in the SCA agent CLI summary.

May 19, 2025​

Fixed SCA agent CLI summary​

Veracode has fixed an issue related to the license counts shown in the summary section of the SCA agent’s command line interface.

May 14, 2025​

Fix for SCA Upload scans of Poetry projects​

Veracode has fixed an issue in SCA Upload scans related to parsing pyproject.toml files with dotted keys.

May 12, 2025​

Fix for SCA agent-based scans of Poetry projects​

Veracode has fixed an issue in SCA agent-based scans related to parsing pyproject.toml files with dotted keys.

May 6, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

April 25, 2025​

SCA Upload support for Python's Poetry package manager​

Veracode SCA Upload scans can now support Python projects that use the Poetry package manager. For pre-requisites, see SCA upload and scan language support matrix.

April 21, 2025​

SCA agent-based scans support for Python's Poetry package manager​

Veracode SCA agent-based scans can now support Python projects that use the Poetry package manager. For pre-requisites, see Python SCA agent-based scanning.

April 18, 2025​

Malicious package detection​

Veracode SCA upload and agent-based scans can now detect and report malicious packages in your libraries. You do not need to take any additional steps to enable this feature or download a new version of the SCA agent.

February 28, 2025​

SCA agent enhancement​

Veracode updated the digital certificate for the SCA agent to enhance its security and trustworthiness. This update introduces an additional layer of protection, enabling customers to verify the source and integrity of the agent file before execution. These changes do not affect agent-based scanning functionality.

February 25, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

February 17, 2025​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

January 30, 2025​

SCA agent URL change​

The default URLs for the Veracode Platform backend API that SCA uses to manage agent-based scans have changed from https://platform-backend.analysiscenter.veracode.eu to https://sca-api.veracode.eu for European region customers and from https://platform-backend.analysiscenter.veracode.us to https://sca-api.veracode.us for United States Federal region customers. These changes do not impact Commercial region customers. All legacy URLs will remain available for the next 12 months before being retired.

For more details on the configuration settings that use these URLs, see SCA agent configuration values and SCA agent environment variables.

January 9, 2025​

If you open a link to view results from an SCA agent-based scan while you are not logged in to the Veracode Platform, Veracode now directs you to the login page and then redirects to the page from the original link.

January 7, 2025​

SCA agent enhancement​

Veracode upgraded several libraries used by the SCA agent. These changes will not impact SCA agent-based scanning.

December 18, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

December 16, 2024​

New URL for downloading the SCA agent​

This update changes the default URL for downloading files from https://download.sourceclear.com to https://sca-downloads.veracode.com. Both URLs will be available for the next 12 months. After that time, https://download.sourceclear.com will no longer be available.

December 12, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

November 18, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent to support autopackaging. These enhancements will not impact SCA agent-based scanning.

October 16, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET, Go, Python, and iOS projects.

October 4, 2024​

SCA agent URL change commercial-icon.png​

The default URL for the Veracode Platform backend API that the SCA agent uses to manage scans for Commercial region customers has changed from https://api.sourceclear.io to https://sca-api.veracode.com. Both URLs will continue to work for the next 12 months, at which point the legacy SourceClear URL will be retired.

For more details on the configuration settings that use these URLs, see SCA agent configuration values and SCA agent environment variables.

September 12, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of Python, PHP, and iOS projects.

September 4, 2024​

SBOM scanning enhancement​

Veracode has added support for scanning SBOM files as part of SCA upload scans.

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of JavaScript projects.

August 27, 2024​

SBOM scanning enhancement​

Veracode has added support for scanning SBOM files as part of SCA agent-based scans.

August 21, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of Java Maven projects.

August 1, 2024​

Fix for agent-based scans of Yarn projects​

Fixed an issue that caused SCA agent-based scans to miss transitive dependencies in Yarn 4 projects.

July 23, 2024​

Improved handling of circular references​

Veracode has improved how SCA upload and agent-based scans handle circular references in NPM projects.

July 16, 2024​

SCA agent enhancement​

Agent enhancements in preparation for future scanning of .NET projects.

July 15, 2024​

Vulnerability side pane added to new SCA homepage (Beta)​

You can now access vulnerability details in a side pane on the Vulnerabilities tab of the new Beta version of the SCA homepage.

July 3, 2024​

SCA results data export​

The SCA Results Export that you can download from the Export Data page in the Veracode Platform now contains 13 months of data instead of 24 months of data.

June 28, 2024​

SCA agent enhancement​

Agent enhancements in preparation for future scanning of .NET projects.

June 25, 2024​

Vulnerable method support for Java 21, 22, and 23​

Veracode SCA agent-based scanning now supports vulnerable method analysis for Java versions 21, 22, and 23.

June 24, 2024​

New component metrics added to SCA agent results​

If an SCA agent-based scan detects a component from a GitHub repository, the CLI summary and the JSON file now include metrics about that repository. Metrics include the number of commits, how long the repository has been stagnant, and more.

June 11, 2024​

New Component Activity API​

Veracode has released a new API to help you understand the health of your components. You can submit library coordinates, and if the library comes from a GitHub repository, the API retrieves metrics about that repository. Metrics include the number of commits, how long the repository has been stagnant, and more. The SCA Component Activity API specification is available on SwaggerHub for more details.

May 30, 2024​

Vulnerabilities and Licenses tabs added to new SCA homepage (Beta)​

You can now see all vulnerabilities from scans performed after March 27, 2024 from the Vulnerabilities tab of the new Beta version of the new SCA homepage. This tab also includes exploitability information from EPSS, KEV, and exploit-DB. License risks from scans you ran after March 27, 2024, are available from the Licenses tab.

To access the new Beta version of the new SCA homepage, select Scans & Analysis > Software Composition Analysis, then, turn on New SCA Home (Beta).

May 28, 2024​

SCA agent enhancement​

Agent enhancements in preparation for future scanning of .NET projects.

May 22, 2024​

SCA agent enhancement​

Agent enhancements in preparation for future scanning of .NET projects.

May 15, 2024​

Fix for SCA scans of NPM projects​

Veracode has fixed an issue that caused some SCA upload scans and some agent-based scans using the --quick flag to not detect libraries in NPM projects when both the project version in the package.json file was empty and the package-lock.json file used v3 format.

May 8, 2024​

Fix for SCA agent-based scans of NPM projects​

Veracode has fixed an issue that caused some SCA agent-based scans to identify libraries in NPM projects as transitive dependencies when they are both direct and transitive dependencies.

April 30, 2024​

Exploitability data added to JSON file produced by SCA agent​

The JSON file produced by SCA agent-based scans now includes the following exploitability data:

April 29, 2024​

SCA agent enhancement​

This update includes the following improvements for SCA agent-based scans:

  • Veracode proxy authentication is more reliable.
  • Improved support of projects that use the version 2 format of yarn.lock.

April 24, 2024​

Fixed SCA agent error​

Veracode has fixed an issue that caused some agent-based scans to fail when Maven is not installed locally.

April 23, 2024​

Additions to JSON file produced by SCA agent​

The JSON file produced by SCA agent-based scans now includes the following enhancements:

  • Includes the Common Vulnerability Scoring System (CVSS) vector string for each vulnerability
  • Associates each vulnerable method with a specific vulnerability

April 17, 2024​

Veracode Vulnerability Database now includes data from Exploit-DB​

The Veracode Vulnerability Database now includes data from Exploit-DB. You can view this data using the SCA Agent Issues APIs and the Findings API. For more information, see Understanding SCA exploitability information.

April 16, 2024​

Fix for SCA agent update advisor​

Veracode has fixed an issue that caused the SCA agent update advisor to not work properly when cloning a repo with https instead of ssh.

April 11, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of iOS and .NET projects and fixed a bug caused by libraries with no versions in Go projects.

April 3, 2024​

API to scan SBOMs​

Veracode has released a REST API for scanning SBOMs. You can use this API to upload and scan an SBOM to identify vulnerabilities associated with the libraries listed in the SBOM. The API can produce a new SBOM that includes results from the scan in CycloneDX or SPDX format. For more information, see SBOM Scan REST API.

April 2, 2024​

Reporting changes for ‘conditional pass’ SCA findings​

Even though policy status can have three possible values—pass, fail, and conditional pass—several reports and APIs with finding-level policy status fields are limited to only two possible values, such as true and false. Veracode has changed how it populates these fields for SCA upload scans to be more consistent with Static Analysis scans.

These changes only affect findings with a conditional pass status. There is no impact on how Veracode calculates the application-level policy status or how the user interface displays the finding-level policy status. For more details, review the post in the Product Announcement group in the Veracode Community.

April 1, 2024​

include_metrics parameter for getWorkspaces API set to FALSE by default​

The default value for the include_metrics parameter has changed from TRUE to FALSE for the getWorkspaces API. When the parameter is FALSE, the API responds more quickly but provides data only for the following fields: id, name, projects_count, and site_id. If you set the parameter to TRUE, the API also provides data for the following fields: last_scan_date, library_issues_count, vulnerability_issues_count, and total_issues_count.

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET and iOS projects.

March 28, 2024​

New SCA homepage (Beta)​

A Beta version of the new SCA homepage is now available in the Veracode Platform. To access the new homepage, select Scans & Analysis > Software Composition Analysis. Then, turn on New SCA Home (Beta). This page is built on a new infrastructure that Veracode will use to provide unified results from SCA upload scans and SCA agent-based scans. To see all applications and workspaces that you scanned after March 27, 2024, select the Portfolio tab. To see all discovered components from scans you ran after March 27, 2024, select the Components tab.

March 27, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET and iOS projects.

March 21, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET and iOS projects.

March 15, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of Ruby and iOS projects.

March 5, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of iOS projects.

February 29, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET, Go, Java Gradle, and Scala SBT projects.

February 27, 2024​

SCA agent enhancement​

Veracode added enhancements to the agent that will be used in the future for scanning of .NET projects.

February 8, 2024​

Vulnerable methods for Go​

Veracode SCA agent-based scanning now supports detecting vulnerable methods in Go projects that use Go modules as the package manager.

Gradle scanning enhancement​

Veracode SCA agent-based scanning now supports scanning Gradle projects without access to the plugin on maven.apache.org. See Run an agent-based scan for Gradle for more details.

New include_metrics parameter for getWorkspaces API​

Veracode has added the include_metrics parameter to the getWorkspaces API. When the parameter is TRUE, there are no changes to the issue count and other metrics that the API includes in the payload. When the parameter is FALSE, the API responds more quickly but provides data only for the following fields: id, name, projects_count, and site_id.

Through March 31st, 2024, the default value for the include_metrics parameter is TRUE. On April 1st, the default will change to FALSE. If you have automation that relies on having issue counts and other metrics, Veracode recommends you adjust the parameter in your API call before April 1st.

January 23, 2024​

Maven scanning enhancement​

Veracode SCA agent-based scanning now supports scanning Maven projects without access to the plugin on maven.apache.org. See Run an agent-based scan for Maven for more details.

Fix for Python scans​

Veracode fixed an issue that caused an error in SCA agent-based scans of Python projects when using a newer version of pipenv.

January 5, 2024​

SCA API enhancements​

Veracode has fixed an issue that caused the SCA Agent Issues APIs to exclude fixed issues from the payload when the vuln_methods parameter was set to true. This fix applies to scans performed after January 5th, 2024.

Additionally, the getProjectIssues endpoint now supports all of the same parameters as the getWorkspaceIssues endpoint.

January 4, 2024​

Veracode Vulnerability Database now includes exploit information​

The Veracode Vulnerability Database now includes data from both the Exploit Prediction Scoring System (EPSS) and the Cybersecurity & Infrastructure Security Agency Known Exploited Vulnerabilities (KEV) catalog. To access this data, you must sign in to the Veracode Platform. For more information, see Understanding SCA exploitability information.

Previous updates​

2023 updates​

2023 updates

December 19, 2023​

SCA agent enhancement​

The SCA agent can now scan target directories that contain spaces when SRCCLR_NO_GIT is set to 1.

December 18, 2023​

APIs now include KEV data​

Veracode has added data from the Cybersecurity & Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalog to the SCA Agent Issues APIs and the Findings API. See Understanding SCA exploitability information for more details.

December 11, 2023​

Veracode has released the SCA App-Linking REST API. You can use this API to link a project for SCA agent-based scans to an application profile. The linked application profile receives all libraries, licenses, and discovered vulnerabilities from that project, along with all results from SCA Upload scans. To link a project, use the linkAppProject endpoint. To unlink a project, use the unlinkAppProject endpoint.

SCA agent enhancement​

Veracode has fixed an issue that prevented the SCA agent from cleaning up local scan directories and added enhancements to the agent that will be used in the future for scanning Java projects.

December 4, 2023​

SCA agent enhancement​

Veracode has added enhancements to the SCA agent that will be used in the future for scanning Java projects.

November 21, 2023​

SCA agent enhancement​

Veracode has added several enhancements and fixes to the SCA agent.

November 14, 2023​

SCA agent enhancement​

Veracode has added enhancements to the SCA agent that will be used in the future for scanning Java projects.

November 6, 2023​

API to propose and approve mitigations for SCA findings​

Veracode has released the SCA Annotations REST API. This API includes the getSCAannotations endpoint to retrieve comments and mitigations applied to findings from SCA upload scans and the createSCAannotations endpoint to annotate SCA upload findings, including adding comments and proposing, accepting, and rejecting mitigations.

The SCA Annotations API specification is available on SwaggerHub.

This API is not part of the Annotations API, which works with findings from Static Analysis and Dynamic Analysis.

October 11, 2023​

Exploit probability (EPSS) added to Findings API​

Veracode has added data from the Exploit Prediction Scoring System (EPSS) to the Findings REST API. See Understanding SCA exploitability information for more details.

Fixed SCA agent error​

Veracode has fixed an issue that caused a null pointer exception when performing an agent-based scan on some projects.

September 27, 2023​

Correction of SCA Fix By dates in sandboxes​

Veracode has fixed an issue impacting the calculation of Fix By dates in sandbox scans. Previously, SCA used the scan date or the scan promotion date as the date that a component was first found, causing the Fix By date to be pushed out continuously. This fix is not retroactive and only impacts scans completed after Sept 27, 2023.

September 22, 2023​

Assign policies to SCA agent-based scan workspaces commercial-icon.png​

The new Unified Policy feature allows you to assign policies to workspaces used for SCA agent-based scans. Like the existing agent rules, you can use policies to create issues and break your build based on certain criteria. See more details about applying rules to a policy, assigning policies to agent-based workspaces, and setting default policies.

Veracode will migrate customers from agent rules to Unified Policy in batches and will retire agent rules before April 1, 2024.

August 28, 2023​

Agent-based scan UI now displays CVSS v3​

Because the National Vulnerability Database stopped supporting CVSS v2 in July 2022 and most users have moved to v3, the Library and Vulnerability pages of SCA's agent-based scan user interface now display CVSS v3 scores, instead of v2. You must clear the cache in your web browser to see these changes.

To also display CVSS v3 on the workspace Issue pages and the project Issue tab, you must update your agent rules to use CVSS v3.

August 16, 2023​

Enhancements to SCA agent dependency graph traversal​

Veracode has improved the performance of the SCA agent by optimizing how it handles dependencies with very complicated and intertwined dependency graphs.

August 8, 2023​

Exploit probability (EPSS) added to SCA Agent APIs​

Veracode has added data from the Exploit Prediction Scoring System (EPSS) to the SCA Agent REST APIs. See Understanding SCA Exploitability Information for more details.

July 21, 2023​

Enhancements to .NET scanning​

Veracode has added the following enhancements to SCA scanning for .NET applications:

  • Reduced false positives and false negatives in SCA upload scans by adding support for deps.json and project.asset.json files.
  • Enhanced SCA Agent scans by adding ability to perform --quick scans on NuGet projects.

July 28, 2023​

API to retrieve list of SCA agent projects linked to an application​

Veracode has released the getApplicationProjects API to allow users to retrieve a list of SCA agent projects that are linked to a specific application. Users who have rights to call the getApplications API may also call the getApplicationProjects API.

July 11, 2023​

Additional roles can call SBOM APIs​

Veracode has expanded the list of roles that are allowed to call the CycloneDX Software Bill of Materials (SBOM) API and the SPDX SBOM API. See the SBOM API instructions for application profiles and agent-based projects for details.

June 28, 2023​

SCA agent CLI now displays CVSS v3 severities​

The Vulnerabilities section of the Summary Report that appears in your CLI after an SCA agent-based scan now displays CVSS v3 severities, instead of v2.

The Issues section still displays CVSS v2 severities by default, but you can edit the severity in your agent-based scanning rules to reflect v3. If you have not modified your rules to use CVSS v3, Veracode recommends setting up organization-level rules to avoid having to edit rules on every workspace individually.

June 20, 2023​

Support for v3 format of NPM lockfiles​

Veracode has added support for NPM lockfile format version 3. See Run an Agent-Based Scan for NPM or JavaScript and TypeScript Packaging for details.

May 15, 2023​

Fixed agent error for Yarn scans​

Veracode has fixed an issue causing SCA agent-based scans of Yarn projects to erroneously fail.

May 9, 2023​

Upgraded JRE for SCA agent​

Veracode has upgraded the Java Runtime Environment (JRE) for the SCA agent from version 11 to 17.

Added GNU Privacy Guard to SCA agent downloads​

Veracode has added GNU Privacy Guard (GPG) signature files to all SCA agent downloads to verify you are downloading a valid version.

May 3, 2023​

Fixed scope parameter for NPM scans​

Veracode has resolved an issue impacting the scope parameter for SCA agent-based scans of NPM projects.

April 14, 2023​

SCA agent enhancements​

Veracode has added the following enhancements to the SCA agent:

  • Support for Gradle version 8.
  • The default scope for scans of NPM projects is now production dependencies instead of all dependencies.
Temporarily ignore issues from agent-based scans​

You can now specify a date for Veracode to stop ignoring issues from SCA agent-based scans.

April 6, 2023​

Enhancements to Go scanning​

Veracode has added the following enhancements to SCA scanning for Go projects:

  • Reduced false positives.
  • Reduced false negatives.
  • Increased scan speed.
  • Fixed an issue that removed component names when agent-based scan results were linked to an application.
  • Fixed an issue that caused indirect dependencies to appear in agent-based scan results as direct libraries instead of transitive libraries.

April 4, 2023​

Enhanced SCA agent support for Java 17 features​

Veracode SCA has improved agent-based scan support for projects that contain Java 17 features.

April 3, 2023​

NVD severity ratings for SCA upload scans​

Veracode Software Composition Analysis (SCA) upload scans now support displaying updated severity ratings that more closely match the National Vulnerability Database (NVD) severity ratings. To enable this feature for your account, contact Veracode Technical Support.

March 16, 2023​

New mitigation type available for SCA upload scans​

You can now choose to accept the risk of specific vulnerabilities and licenses as part of your mitigation process for Veracode SCA upload scans. This mitigation type is already available for Veracode Static Analysis and Dynamic Analysis.

February 3, 2023​

Region flag for agent-based scans ​

Veracode SCA agent-based scans now include a region flag that you can use to configure accounts in the European or United States Federal region.

February 2, 2023​

JRE upgrade for SCA agent​

Veracode has upgraded the Java Runtime Environment (JRE) that is bundled with the Software Composition Analysis (SCA) agent.

January 13, 2023​

Improved SCA support for Python 3​

Veracode Software Composition Analysis (SCA) agent-based scans now more effectively locate local Python 3 installations.

2022 updates​

2022 updates

December 21, 2022​

Generate SBOM in SPDX format​

You can now use the Veracode SCA Agent REST API to create a software bill of materials (SBOM) in SPDX JSON format from the results of your Veracode SCA upload scans.

December 14, 2022​

SCA support for Android​

Veracode Software Composition Analysis (SCA) now supports scanning Android projects. This support includes AAR files for agent-based scans and APK and AAB files for upload scans.

September 15, 2022​

SCA support for Go aliases​

Veracode Software Composition Analysis (SCA) now supports aliases in Go projects. This support includes agent-based and upload scans.

Vulnerable method support for Java 17​

Veracode SCA agent-based scanning now supports vulnerable method analysis for Java 17.

August 22, 2022​

Set SCM URI as project name​

You can now set the source code management (SCM) URI as your project name using the --uri-as-name option in your Veracode SCA agent-based scans.

July 22, 2022​

SBOM API support for SCA agent-based scans linked to application profiles​

You can now use the Veracode SCA Agent REST API to create a software bill of materials (SBOM) from the results of your Veracode SCA agent-based scans that you have linked to an application profile. The API generates an SBOM in CycloneDX JSON format.

June 6, 2022​

Generate SBOMs for SCA agent-based scans with the REST API​

You can now use the Veracode SCA Agent REST API to create a software bill of materials (SBOM) from the results of your Veracode SCA agent-based scans. The API generates an SBOM in CycloneDX JSON format.

May 9, 2022​

SBOM API support for promoted sandbox scans​

You can now generate a software bill of materials (SBOM) for Veracode SCA upload scans that have been promoted from sandbox to policy scans. The Veracode SCA Agent REST API includes promoted sandbox scan results when it returns a CycloneDX SBOM for an application.

SCA upload and scan table update​

Veracode has removed the Number of Known Vulnerabilities by Severity column from the Applications table on the Upload and Scan page in the Veracode Platform. This update significantly reduces load times for the page. You can still view the number of known vulnerabilities by severity for each application in the application profile.

April 26, 2022​

Generate SBOMs for SCA upload scans with the REST API​

You can now use the Veracode SCA Agent REST API to create a software bill of materials (SBOM) from the results of your Veracode SCA upload scans. The API generates an SBOM in CycloneDX JSON format.

January 20, 2022​

JSON output for agent-based scans includes CVSS v3 score​

Veracode Software Composition Analysis (SCA) now provides the CVSS version 3 score in the JSON CLI output of your agent-based scan results. To use this feature, you must upgrade your Veracode SCA agent to version 3.7.77 or later.

2021 updates​

2021 updates

October 20, 2021​

Veracode European region now available ​

The Veracode European region is now available for new customers. This region, which initially supports Veracode Static Analysis and Veracode Software Composition Analysis, provides European data residency for Veracode customers.

2020 updates​

2020 updates

December 17, 2020​

Container Scanning for Debian​
  • Veracode Software Composition Analysis now supports agent-based scans of Debian Docker containers. You can scan Debian containers through the command-line interface or as part of your continuous integration pipelines.

October 15, 2020​

Set Default Branch to the Most Recently Scanned Branch or Tag​

  • You can now set your Veracode Software Composition Analysis projects to automatically update their default branch to be the most recently scanned branch or tag. This enhancement enables the use of tags as default branches and reduces the number of issues that display in the Veracode Platform, by default.

  • Existing projects without a default branch selected in their project settings now use the Use Last Scanned option as the default branch.

October 13, 2020​

Vulnerable Method Support for JavaScript​
  • Veracode Software Composition Analysis supports vulnerable method analysis for agent-based scans of JavaScript applications. This feature helps prioritize your remediation actions by identifying first-party code that calls a function in a JavaScript library that makes the library vulnerable.

October 1, 2020​

Container Scanning for Ubuntu​
  • Veracode Software Composition Analysis now supports agent-based scans of Ubuntu Docker containers. You can scan Ubuntu containers through the command-line interface or as part of your continuous integration pipelines.

September 26, 2020​

Grace Periods for SCA Policy Rules​
  • Veracode Software Composition Analysis now allows you to include grace periods for SCA upload scans in your application security policies. You can define a grace period for all scan types, including SCA, or define a grace period that applies specifically to SCA scans.

July 17, 2020​

Default Date Limit Applied to Scan Data in Agent-Based Scan Workspaces​
  • To improve performance and usability, the scan data for your workspaces is now limited to projects scanned in the last 30 days, by default. You can change the time window of exported projects on the workspace page in the Veracode Platform.

July 7, 2020​

Advanced License Risk Management for Agent-Based Scans​
  • Veracode Software Composition Analysis now provides advanced license risk management capabilities for agent-based scans. You can control the acceptable risk from open-source libraries by adding rules based on Veracode license risk ratings or by rejecting specific licenses.

June 17, 2020​

New API Endpoints for Agent Management​
  • The Veracode SCA Agent REST API includes new endpoints for creating and deleting agents. This update enables you to more effectively scale your agent administration and improve productivity with agent-based scans.

May 28, 2020​

Issue Summary for Agent-Based Scans​
  • Veracode Software Composition Analysis now provides a summary table on each agent-based scan workspace and project page that provides a quick view of the state of your open-source issues.

April 29, 2020​

Vulnerability Database Update​

  • The Veracode Vulnerability Database is updated to resolve a discrepancy in severity rating compared to the National Vulnerability Database (NVD) for approximately 200 of over 20,000 total vulnerabilities. Veracode has already contacted all organizations that have applications that fail policy as a result of this update.

  • If your Veracode account manager has not contacted you, you do not need to take any action.

April 6, 2020​

Alpine Linux Support for Agent-Based Scans​
  • Veracode Software Composition Analysis (SCA) now supports the Alpine Linux distribution for agent-based scans.
Organization Rules for Agent-Based Scans​
  • Veracode Software Composition Analysis (SCA) now supports configuring rules for agent-based scans at the organization level. Administrators can apply these rules to all workspaces in an organization to efficiently enforce a common security standard.

April 3, 2020​

New API Endpoint for Auditing Agent-Based Scan Events​
  • The Veracode SCA Agent REST API includes a new endpoint that provides a detailed audit of events for agent-based scans.

March 17, 2020​

License Risk Details for Agent-Based Scans​
  • Veracode Software Composition Analysis (SCA) provides the license risk rating of each open-source license type identified in agent-based scans to help you make informed decisions about acceptable risk.
Gem Support for Containers​
  • Agent-based scans now support the gem package manager for scanning Docker containers.

March 16, 2020​

New Video - Set Up an Agent to Scan with Veracode Software Composition Analysis​

This video shows you how to:

  • Create a workspace
  • Set up an agent
  • Start a scan from your command line
  • View scan results

February 13, 2020​

NPM and Pip Support for Containers​
  • Agent-based scans now support the NPM and pip package managers for scanning Docker containers.

January 29, 2020​

Update to Integrated SCA Upload and Scan​
  • If you use Veracode Integrated Software Composition Analysis without a Veracode Static Analysis subscription, you can now perform scans using the upload and scan method.
SCA Results Export​
  • You can now generate and download your latest Software Composition Analysis results from the Export Data page in the Veracode Platform at any time. This report does not include data from agent-based scans.

January 24, 2020​

New Video - Upload and Scan with Veracode Software Composition Analysis​
  • This video shows you how to upload and scan applications with Veracode Software Composition Analysis.

January 15, 2020​

Get Teams List with the SCA Agent REST API​
  • The Veracode SCA Agent REST API for Veracode Agent-Based Scan now supports retrieving a list of the teams in an organization, including filtering by the full or partial team name.
]]> <![CDATA[Static Analysis updates]]> https://docs.veracode.com/updates/r/c_all_static 2026-09-23T00:00:00.000Z The updates on this page apply to Veracode Static Application Security Testing (SAST). Subscribe to the Static Analysis updates RSS feed Feed-icon.png.

Updates that apply to specific Veracode regions show a region icon.

For language support specific to Veracode Pipeline Scan, see Pipeline Scan Supported Languages.

September 23, 2026​

Static Analysis Engine v2026.09​

.NET​

  • Improves detection of CWE-259 and CWE-798 flaws, reducing false positives.

Android​

  • Enhances support for Android 16.

Apple Platforms​

  • Adds support for iOS 27.

Go​

  • Adds support for Go 1.27.

PL/SQL​

  • Improves parsing of PL/SQL code.

Python​

  • Improves detection of CWE-89 flaws in PySpark applications.
  • Improves SQLAlchemy analysis to reduce false positives when detecting CWE-89 flaws.
  • Improves detection of third-party code.

RPG​

  • Improves detection of CWE-200 flaws, reducing false positives.
  • Improves analysis of CALL commands to enhance detection of CWE-252 flaws.

September 16, 2026​

Veracode Static Analysis integration with DryRun Security​

Veracode Static Analysis now integrates with DryRun Security to bring Veracode findings and security context into AI-native developer workflows.

  • Incorporates Veracode Static Analysis findings into DryRun Security analysis and developer workflows.
  • Combines Veracode's deterministic static analysis with DryRun Security's contextual AI analysis to improve accuracy and extend coverage to business logic flaws.
  • Surfaces security context during pull request and code review workflows.
  • Provides Veracode findings as trusted security signals and remediation guidance for AI-assisted development tools.
  • Maintains Veracode Static Analysis as the authoritative source for Veracode findings while DryRun Security provides additional contextual analysis and developer guidance.

Enhanced Python scanner flaw matching​

  • Following the transition to Veracode’s enhanced Python scanner on July 22, 2026, some customers might have experienced a one-time change in flaw matching compared with scans performed using the previous scanner. As a result, certain previously identified flaws might not match their historical findings, and previously applied mitigations might need to be reapplied.
  • This behavior is limited to the transition to the enhanced scanner. After an application establishes its initial scan baseline with the enhanced scanner, subsequent scans use that baseline for consistent flaw matching.

September 3, 2026​

Language support and analysis improvements​

Dart and Flutter​

  • Adds support for Dart 3.13 and Flutter 3.47.

PHP​

  • Adds support for PHP 8.4 and PHP 8.5.

Python​

  • Improves handling of dynamic top-level directory structures and parsing of third-party libraries.

August 26, 2026​

Static Analysis Engine v2026.08​

Android​

  • Enhances support for Android 16.
  • Improves detection of third-party code.

Dart and Flutter​

  • Adds support for detecting hardcoded values in get assignments modeled as getter functions.

Java​

  • Improves Java scan performance when analyzing common template patterns.
  • Improves detection of CWE-78 flaws.

JavaScript​

  • Adds support for Next.js 16.x.
  • Improves detection of CWE-80 flaws involving React useState.

PHP​

  • Improves detection of third-party code.

PL/SQL​

  • Improves scan performance.

Python​

  • Improves detection of hardcoded passwords and credentials associated with CWE-259 and CWE-798.
  • Adds support for the Python google-cloud-bigquery library.

RPG​

  • Improves remediation guidance for flaws associated with CWE-78, CWE-114, CWE-200, CWE-338, CWE-359, CWE-628, CWE-787, and CWE-823.
  • Improves detection of CWE-787 flaws to reduce false positives.
  • Improves RPG parsing.

Other languages​

Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

July 29, 2026​

Pipeline Scan supports artifacts larger than 200 MB​

This update adds support for scanning packaged artifacts larger than 200 MB. No changes to existing integrations are required.

July 22, 2026​

Enhanced Python scanner​

  • Improves vulnerability detection through enhanced taint tracking, cross-file analysis, and pattern recognition. Adds support for applications built with PySpark, Flask, Django, and FastAPI.
  • Future scans might identify additional findings because of the enhanced analysis. These findings represent previously undetected vulnerabilities, not regressions or newly introduced issues.
  • Applies automatically to all Python scans starting July 22, 2026. No configuration changes are required.

July 21, 2026​

Static Analysis Engine v2026.07​

.NET​

  • Enhances support for .NET 10.
  • Improves analysis of applications that include Saturn.dll.

Android​

  • Adds support for Android 17.

Apex​

  • Improves detection of CWE-80 flaws.

Dart and Flutter​

  • Improves detection of third-party Dart packages.

Java​

  • Improves JSP and JSF Expression Language modeling by incorporating more complete data about POJOs, which might identify additional valid findings.
  • Improves scan accuracy for code generated by Project Lombok.
  • Expands third-party library detection to include Fluxnova.

JavaScript​

  • Improves analysis of the spread operator to reduce false positives.
  • Expands support for pnpm modules to improve dependency resolution.
  • Improves detection of CWE-80 flaws in React Native applications.

Python​

  • Improves propagation support for os.path functions.
  • Adds support for httplib when detecting CWE-295 and CWE-297 flaws related to SSL/TLS.

PL/SQL​

  • Improves parsing of PL/SQL code.

Other languages​

Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

June 24, 2026​

Static Analysis Engine v2026.06​

.NET​

  • Improves classification of first-party .NET assemblies to better distinguish application code from third-party dependencies.

Apex​

  • Improves detection of vulnerabilities that involve tainted data flows through public methods.
  • Improves detection of CWE-532 flaws.

Apple Platforms​

  • Improves support for Security APIs.

Dart and Flutter​

  • Adds support for Dart 3.12 and Flutter 3.44.

Kotlin​

  • Adds support for Kotlin 2.4.

Java​

  • Improves third-party detection.
  • Improves detection and classification of ForgeRock third-party dependencies in Maven-based projects.
  • Improves detection of CWE-918 flaws.

JavaScript​

  • Improves detection of CWE-73 flaws.
  • Improves third-party detection.

Python​

  • Improves third-party detection.

RPG​

  • Improves RPG parsing.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

May 27, 2026​

Static Analysis Engine v2026.05​

.NET​

  • Updates the .NET third-party dependency database with the latest NuGet package data.
  • Improves detection of the PdfPig third-party library.

Apple Platforms​

  • Adds support for the CloudKit framework.
  • Adds support for Apple Security framework APIs.
  • Improves detection of third-party libraries.

COBOL​

  • Improves COBOL scan logging for better visibility during analysis.

Java​

  • Enhances support for JDK 25.
  • Improves Java source code scanning for JSP files.
  • Improves detection of the Snowflake JDBC Driver third-party library.

Python​

  • Improves scan detection for the anticrlf cleanser function.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

April 22, 2026​

Static Analysis Engine v2026.04​

Apple platforms​

  • Adds support for applications built with Xcode 26.4.

COBOL​

  • Improves COBOL parsing.

Dart and Flutter​

  • Added support for Dart 3.11 and Flutter 3.41.

Java​

  • Adds support for JDK 26.
  • Adds support for scanning Java source code.
  • Adds support for viewing Java source code on the platform.
  • Improves detection of third-party libraries
  • Adds support for excluding Java .jar files from static analysis by using veracode.json.
  • Expands hardcoded secrets detection to include application configuration files with -local and -prod naming patterns.

JavaScript​

  • Adds support for React 19

Kotlin​

  • Adds support for Kotlin 2.3.

Python​

  • Adds support for Psycopg 3 in Python applications.

Ruby on Rails​

  • Improves detection of CWE-352.

RPG​

  • Enhanced scan accuracy for RPG source files with .MBR extension.

T-SQL​

  • Improves parsing of T-SQL code.

March 23, 2026​

Static Analysis Engine v2026.03​

.NET​

  • Improves detection of third-party libraries.

Apex​

  • Improves detection of CWE‑201 and CWE‑798, reducing false positives.
  • Skips @isTest methods during scans to reduce noise and improve result quality.

Apple platforms​

  • Improves scan performance for iOS projects.

COBOL​

  • Improves COBOL parsing.

Go​

  • Adds support for Fast HTTP.

Java​

  • Improves detection of third-party libraries from Maven repositories.
  • Improves detection of CWE-80.
  • Improves detection of CWE‑117 and CWE‑918, reducing false positives.

JavaScript​

  • Adds support for Angular 20.
  • Adds support for Next.js 15.x.

PL/SQL​

  • Improves PL/SQL code parsing.

Python​

  • Improves detection of CWE-73.
  • Adds taint sinks for the following functions:
    • send_from_directory
    • send_file

February 23, 2026​

Static Analysis Engine v2026.02​

.NET​

  • Expands .NET taint sink coverage for CWE‑80: Cross-Site Scripting to detect:
    • System.Web.UI.Page.Title
    • System.Web.UI.HtmlControls.HtmlHead.Title

Apple Platforms​

  • Adds taint propagation support for framework APIs.

Go​

  • Adds support for Go 1.26.

Java​

  • Improves cleanser detection for CWE-73.
  • Adds support for excluding specific Java classes from Static Analysis through the veracode.json configuration file.

JavaScript​

  • Improves scan performance.

Python​

  • Adds support for PyYAML.

January 28, 2026​

Static Analysis Engine v2026.01​

.NET​

  • Improves scan performance and result quality.

Android​

  • Improves detection of CWE-926 flaws to reduce false positives.

Apex​

  • Adds support for Apex 64 and Apex 65.
  • Improves detection of CWE-259, CWE-532, CWE-693, and CWE-798 flaws.

Apple Platforms​

  • Improves mobile behavioral detection for iOS 26.

C/C++​

  • Improves detection of third-party code.

Java​

  • Adds support for Spring Boot 4, Spring Core 7, and Spring Security 7.
  • Improves detection of CWE-104.

JavaScript​

  • Adds support for the Svelte framework.

Kotlin​

  • Improves detection of CWE-798 flaws to reduce false positives.

Ruby on Rails​

  • Adds support for Ruby 4.0 and Rails 8.1.

T-SQL​

  • Improves parsing of T‑SQL code.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

December 17, 2025​

Static Analysis Engine v2025.12​

.NET​

  • Adds support for .NET 10.
  • Improves detection of CWE-321 for ENCRYPTION_SALT_KEY and ENCRYPTION_IV_KEY.
  • Improves detection of CWE-78 flaws.

Android​

  • Improves third-party library detection for React.
  • Improves third-party library detection for Seismic.

COBOL​

  • Improves COBOL code parsing.

Dart and Flutter​

  • Adds support for Dart 3.10 and Flutter 3.38.

Go​

  • Adds support for the Go Fiber web framework.

iOS​

  • Adds taint propagation support for the Swift standard library.

Java​

  • Improves detection of CWE-918.
  • Improves cleanser detection for CWE-73.

JavaScript​

  • Improves detection of CWE-80 flaws to reduce false positives.

T-SQL​

  • Improves T-SQL code parsing.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

November 20, 2025​

Static Analysis Engine v2025.11​

C/C++​

  • Improves detection of third-party code.

COBOL​

  • Improves flaw detection in conditional variable initialization to reduce false positives.
  • Improves COBOL code parsing.

Java​

  • Enhances identification of first-party code in WEB-INF/classes with non-standard or mismatched package names.
  • Improves detection of third-party libraries from Maven repositories.

PL/SQL​

  • Improves PL/SQL code parsing.

Python​

  • Adds support for AWS Glue.
  • Improves detection of hardcoded passwords and credentials (CWE-259 and CWE-798).
  • Increases scan performance.
  • Enhances cleanser detection for CWE-117.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all supported languages to reduce false positives.

October 22, 2025​

Static Analysis Engine v2025.10​

.NET​

  • Adds support for Semantic Kernel (SK) KernelContent and Taint Injection.
  • Improves detection of third-party code.
  • Improves detection of CWE-352 flaws.

Android​

  • Skips ProGuard-obfuscated classes to improve scan performance.
  • Optimizes Android scans to reduce analysis time.

C/C++​

  • Improves detection of CWE-73 flaws.

COBOL​

  • Enhances COBOL parsing to automatically detect copybooks.

Java​

  • Improves detection of CWE-611 flaws.
  • Enhances identification of third-party code.

Python​

  • Adds support for PySpark.
  • Adds support for DynamoDB.
  • Adds support for FastAPI.

Other languages​

  • Improves detection of CWE-259 and CWE-798 flaws across all supported languages to reduce false positives.

September 25, 2025​

Static Analysis Engine v2025.09​

.NET​

  • Adds support for Semantic Kernel (SK) InvocationFilter and Filter.

Dart and Flutter​

  • Adds support for Dart 3.9 and Flutter 3.35.

iOS​

  • Updates Gen IR: the --capture flag now includes diagnostic data in .xcarchive files to help with troubleshooting.

Java​

  • Adds support for JDK 25 (LTS).
  • Improves detection and reporting of insecure implementations involving encrypted values.

PL/SQL​

  • Improves parsing of PL/SQL code.

Python​

  • Enhances detection of CWE-89 in AWS Lambda environments.

Other languages​

  • Removes support for selecting third-party modules to improve scan accuracy and performance.
  • Enhances flaw detection for CWE-259 and CWE-798 to reduce false positives across supported languages.

September 15, 2025​

Updated language and framework support​

iOS​

  • Adds initial support for iOS 26.

August 27, 2025​

Static Analysis Engine v2025.08​

.NET​

  • Adds support for .NET Semantic Kernel (SK) to detect hardcoded credentials (CWE-798) and configuration control issues (CWE-15).
  • Adds support for Azure Functions v4 on .NET 9 in isolated process mode.

Dart and Flutter​

  • Adds support for Dart 3.8 and Flutter 3.32.

Go​

  • Adds support for Go 1.25.

Java​

  • Adds support for Micronaut 4.x.
  • Improves support for Quarkus.
  • Enhances third-party library detection for Maven repositories.
  • Improves CWE-918 detection to reduce false positives.

JavaScript​

  • Adds support for Node.js 22.x.

Scala​

  • Adds support for Scala 3.7.

T-SQL​

  • Improves T-SQL code parsing.

Other languages​

  • Enhances flaw detection for CWE-259 and CWE-798 across supported languages to reduce false positives.

August 4, 2025​

Pipeline Scan output now displays the finding exploit level​

The results.json output file from a Pipeline Scan now includes the finding exploit level. When you run a Pipeline Scan in the Veracode CLI or with the APIs, the exploit level is a numeric value from -2 to 2, where -2 is Very Unlikely and 2 is Very Likely.

July 24, 2025​

Updated language and framework support​

.NET​

  • Adds support for detecting CWE-285 flaws in ASP.NET Core MVC controllers.

Android​

  • Introduces initial support for Android 16.

Apex​

  • Adds support for Apex 63.
  • Improves detection of SOSL FIND queries. This update might increase findings for CWE-274 and CWE-284, and reduce findings for CWE-943.

Go​

  • Adds support for Go version 1.24.5.

COBOL​

  • Improves COBOL code parsing.

Java​

  • Improves detection of third-party libraries from Maven repositories.
  • Improves detection of org.owasp.esapi.Logger for better coverage of logging-related flaws.

JavaScript​

  • Improves detection of CWE-80 flaws in Node.js applications.
  • Improves detection of CWE-321 flaws in CryptoJS AES encryption and decryption calls.

PHP​

  • Reduces analysis times for WordPress applications. WordPress is not a supported framework, and result quality may be limited.

PL/SQL​

  • Improves PL/SQL code parsing.

T-SQL​

  • Improves T-SQL code parsing.

June 26, 2025​

Updated language and framework support​

.NET​

  • Enhanced flaw detection for CWE-201 to reduce false positives.

C/C++​

  • Improved error handling during code parsing.

COBOL​

  • Improved flaw analysis for CWE-489 to reduce false positives.

iOS​

  • Improved flaw detection for CWE-201 to reduce false positives.

Java​

  • Identifies use of FileUtils.File from Apache Commons IO as a potential security risk (CWE-73).
  • Improved flaw detection for CWE-80 to reduce false positives.
  • Improved cleanser detection for CWE-113.

Kotlin​

  • Added support for the Ktor framework.

T-SQL​

  • Improved flaw detection for CWE-89.

Other languages​

  • Enhanced flaw detection for CWE-259 and CWE-798 to reduce false positives across supported languages.

June 19, 2025​

Added Java risky functions for CWE-918 detection​

Risky Java functions associated with CWE-918: Server-Side Request Forgery (SSRF) are now flagged. The following functions are now included:

  • URL.openConnection()
  • URL.openConnection(Proxy)
  • URL.openStream()
  • URL.getContent()

These changes might increase CWE-918 findings in your applications and affect other taint-based categories, such as CWE-80, CWE-201, and CWE-209.

May 22, 2025​

Updated language and framework support​

.NET​

  • Enhanced support for .NET 9

Android​

  • Enhanced support for Android 15

Apex​

  • Improved CWE-943 flaw detection for static final fields to reduce false positives

C/C++​

  • Improved parsing of C/C++ code
  • Added support for the GCC 14.2.0 compiler
  • Improved preprocessor line directive mapping to customer source files
  • Enhanced detection of third-party code

COBOL​

  • Added support for HP TNS Timed Input and Output constructs
  • Added support for HP TNS EXTENDED-STORAGE sections

Java​

  • Improved detection of third-party code
  • Improved parsing of Java code

JavaScript​

  • Improved Cross-Site Scripting (XSS) flaw detection

Kotlin​

  • Added support for Kotlin 2.1

PHP​

  • Improved file path identification to support case-sensitive file systems. This change triggers a one-time update to flaw matching and assigns new flaw IDs to PHP files with uppercase letters in their filenames.

Python​

  • Improved detection of CWE-259 flaws

Other languages​

  • Improved detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives

April 24, 2025​

Updated language and framework support​

.NET​

  • Improved CWE-117 flaw detection to reduce false positives
  • Enhanced detection of SQL injection vulnerabilities

Android​

  • Improved detection of third-party libraries

Apex​

  • Improved scan performance

Go​

  • Enhanced analysis of slices and maps packages

iOS​

  • Improved CWE-201 flaw detection to reduce false positives

Java​

  • Added support for JDK 24
  • Improved cleanser detection for CWE-117

JavaScript and TypeScript​

  • Added support for Angular 19

  • Enhanced support for Angular 18

  • Added support for Azure Functions v4

  • Improved CWE-918 flaw detection

Kotlin​

  • Enhanced support for Kotlin 2.0

PL/SQL​

  • Improved scan performance

T-SQL​

  • Improved parsing of T-SQL code

VB6​

  • Improved scan performance

Other languages​

  • Improved detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives

March 27, 2025​

Updated language and framework support​

.NET​

  • Enhanced support for .NET 9
  • Improved detection of CWE-89 flaws

Apex​

  • Added support for Apex 61 and 62

COBOL​

  • Improved parsing of COBOL code

Dart and Flutter​

  • Added support for Dart 3.7 and Flutter 3.29

Go​

  • Added support for Go 1.24

Java​

  • Improved detection of CWE-942 flaws
  • Enhanced detection of third-party code

JavaScript and TypeScript​

  • Enhanced detection of third-party code

Python​

  • Improved detection of hardcoded passwords and credentials (CWE-259 and CWE-798)

PL/SQL​

  • Improved parsing of PL/SQL code

T-SQL​

  • Improved parsing of T-SQL code

Other languages​

  • Improved detection of CWE-259 and CWE-798 flaws across all languages, reducing false positives

February 27, 2025​

Updated language and framework support​

C/C++​

  • Improved flaw detection for exported functions.

iOS​

  • Improved detection accuracy for taint-based flaws.

JavaScript​

  • Enhanced support for Angular 18.

PL/SQL​

  • Enhanced flaw detection for out-of-scope code, reducing false positives.
  • Improved detection of flaws in variables initialized with a taint source, which might increase the number of reported flaws.
  • Enhanced SQL injection detection.

Ruby on Rails​

  • Added support for Rails 3.4 and Rails 8.

Other languages​

  • Improved detection for CWE-259 and CWE-798 flaws, reducing false positives across all languages.
  • Enhanced flaw descriptions and remediation details for CWE-284 and CWE-115.
  • Updated CWE Top 25 to the 2024 version, impacting all policies with Auto-Update CWE Top 25 as a requirement.

January 27, 2025​

Updated language and framework support​

.NET​

  • Improved CWE-1174 flaw detection resulting in a reduction in false positives

Dart and Flutter​

  • Dart 3.6 and Flutter 3.27 support

Java​

  • Improved third-party code detection
  • Improved cleanser detection for CWE-117

JavaScript and TypeScript​

  • Improved CWE-80 flaw detection
  • Improved third-party code detection

PHP​

  • Enhanced overall flaw detection for PHP, which may lead to an increase in the number of reported flaws

PL/SQL​

  • Improved parsing for PL/SQL

T-SQL​

  • Improved SQL injection detection
  • Improved parsing for T-SQL

Other languages​

  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives for all languages

December 17, 2024​

Updated language and framework support​

.NET​

  • .NET 8 MAUI support

Go​

  • Cobra support

iOS​

  • Enhanced support for iOS 18
  • Improved mobile behavioral detection for iOS 18
  • Improved Foundation framework support for iOS 18
  • Improved HealthKit framework support for iOS 18
  • Improved Swift Memory Management support for iOS 18

Java​

  • Improved third-party code detection

JavaScript​

  • Added NestJS 10.3.x support

November 21, 2024​

Updated language and framework support​

.NET​

  • Initial support for .NET 9

Go​

  • Go 1.23 support

iOS​

  • Improved Contacts framework support

T-SQL​

  • Improved scan performance

October 31, 2024​

Updated language and framework support​

.NET​

  • Improved third-party detection

Java​

  • Added JDK 23 support
  • Improved Spring Security 5 and 6 support
  • Improved CWE-352 flaw detection
  • Improved CWE-80 flaw detection resulting in a reduction in false positives
  • Improved third-party detection

JavaScript​

  • Improved CWE-80 and CWE-601 flaw detection resulting in a reduction in false positives
  • Improved third-party detection

September 26, 2024​

Updated language and framework support​

.NET​

  • Improved cleanser detection for CWE-113

Android​

  • Initial support for Android 15

Go​

  • Enhanced Go AWS Lambda package support

iOS​

  • Enhanced support for iOS 17
  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives

Java​

  • Improved handling of detected third-party class files in Uber JAR applications and third-party JAR files in WAR, EAR, and Spring Boot applications. As a result, analysis is more concise and accurate, resulting in both improved scan performance and more accurate findings
  • Improved CWE-73 and 327 flaw detection
  • Improved third-party detection

PHP​

  • Added Laravel Blade and Views support

PL/SQL​

  • Improved SQL parsing support

Ruby on Rails​

  • Rails 7.2 support

T-SQL​

  • Improved SQL parsing support

Other languages​

  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives for all languages

September 16, 2024​

Updated language and framework support​

iOS​

  • Initial support for iOS 18

Scan results for any iOS applications built with Xcode versions older than Xcode 15.3 may be degraded. Veracode recommends that iOS applications be built with Xcode 15.3 or later for best results

September 13, 2024​

Updated language and framework support​

iOS​

Veracode has released version 0.5.0 of Gen IR, the iOS packaging tool, to GitHub and Homebrew. It includes the following new features and improvements:

  • Added PIFSupport library that integrates the Project Interchange Format (PIF) into Gen IR. This new library allows Veracode to better interact with project models from Xcode and SPM, offering a more structured and publicly documented alternative to PBXProject. With this change, Veracode can now discover and decode the PIF cache, which allows Gen IR to better parse and reason about complex project structures and dependencies between targets in a project. Benefits of this change include:

    • Simplified project parsing: PIF’s structure is easier to consume and more robust.
    • Enhanced compatibility: improved handling of dependencies and other existing issues.
    • Future-proofing: aligns with modern development tools and workflows in Xcode and SwiftPM.

  • Support for projects built or generated with Xcode 16.

If you need to downgrade to the previous version, use a new Homebrew formula:

  • If you already have Gen IR installed: brew install gen-ir@0.4.3
  • If you do not have Gen IR installed: brew install gen-ir@0.4.3

To upgrade your installed Gen IR to the new version, run brew update && brew upgrade

August 26, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-316 flaw detection, resulting in a reduction in false positives

Apex​

  • Enhanced Apex 60 support
  • Improved CWE-274 detection

Dart and Flutter​

  • Dart 3.5 and Flutter 3.24 support

Go​

  • Go AWS Lambda package support

iOS​

  • Improved CWE-297 detection in Swift applications
  • Improved CWE-323 support for iOS 17 APIs
  • Improved third-party detection for NuGet repositories

Java​

  • Improved third-party detection for Maven repositories
  • Improved CWE-259 and 798 flaw detection for Spring Boot applications, resulting in a reduction in false positives
  • Improved SQL injection detection

JavaScript​

  • Angular 17 support

Kotlin​

  • Kotlin 2.0 support

Scala​

  • Enhanced Scala 3.4 support

Other languages​

  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives for all languages

Sept. 20, 2024​

Updated Pipeline Scan language support​

Pipeline Scan now supports Apex.

Aug. 8, 2024​

Updated Pipeline Scan language support​

Pipeline Scan now supports COBOL.

July 31, 2024​

Improved prescan performance​

The Static Analysis prescan processor is updated to improve performance. This update has no impact on your scan results and requires no user action.

July 25, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-327 flaw detection

APEX​

  • Added CWE-274 support for Apex

C/C++​

  • Improved third-party detection for C/C++

iOS​

  • Improved CWE-252 and 321 support for iOS 17 APIs

Java​

  • Skip annotation if every data path has a corresponding cleanser

Python​

  • Improved flaw detection for Python Lambda

T-SQL​

  • Improved parsing for T-SQL

July 2, 2024​

Updated Pipeline Scan language support​

Pipeline Scan now supports iOS.

June 27, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-117 and 1174 flaw detection for .NET resulting in a reduction in false positives

Apex​

  • Improved parsing for Apex

C/C++​

  • Added Visual Studio 2022 MSVC 14.4x compiler support
  • Improved scan performance for C/C++ Linux

COBOL​

  • Improved parsing for COBOL
  • Improved CWE-248 flaw detection for COBOL resulting in a reduction in false positives

Dart and Flutter​

  • Dart 3.4 and Flutter 3.22 support

iOS​

  • Improved CWE-201 support for iOS 17 APIs
  • Improved third-party detection for iOS resulting in a reduction in false positives

Java​

  • Improved line number detection for flaws

JavaScript​

  • Added Next.js 14.x support
  • Improved parsing for TypeScript

Ruby on Rails​

  • Ruby 3.3 and Rails 7.1 support

Other languages​

  • Improved CWE-201 support for iOS 17 APIs
  • Improved CWE-331 support for Android
  • Improved CWE-259 and 798 flaw detection for all languages resulting in a reduction in false positives
  • Removed CGI-only restriction for Perl
  • Improved CWE-80 flaw detection for PHP
  • Improved parsing for T-SQL
  • Improved CWE-259 flaw detection for Python resulting in a reduction in false positives

May 23, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-73, 259, and 798 detection
  • Improved third-party detection
  • Improved SQL injection detection

APEX​

  • Apex 57, 58, 59, and 60 support

COBOL​

  • Stratus VOS COBOL support

Java​

  • Enhanced JDK 21 and 22 support
  • Improved cleanser detection for CWE-78
  • Improved CWE-259, 798, and 916 flaw detection resulting in a reduction in false positives
  • Improved third-party detection for Maven repositories

Scala​

  • Scala 3.4 support

Other languages​

  • Improved CWE-259 and 798 detection for all languages
  • Improved CWE-89 detection for T-SQL
  • Improved CWE-259, 319, and mobile behavioral scan support for iOS 17 APIs
  • Improved parsing for T-SQL
  • Improved CWE-80 flaw detection for TypeScript resulting in a reduction in false positives
  • Improved SQL injection detection for Python

April 25, 2024​

Updated language and framework support​

.NET​

  • Improved third-party detection

COBOL​

  • You must now submit all COBOL files as separate files in a single archive. Veracode no longer supports uploading individual COBOL files outside of an archive.

C/C++​

  • GCC 12 and 13 (RHEL 9) support
  • openSUSE Leap version 15 support
  • Improved CWE-121 and 454 detection

Dart and Flutter​

  • Dart 3.3 and Flutter 3.19 support

Java​

  • JDK 22 support
  • Improved CWE-259 and 798 flaw detection for Spring Boot applications, resulting in a reduction in false positives
  • Improved Generic modeling, which impacts all CWEs

JavaScript​

  • JavaScript cleansers for CWE-80, 93, 113, and 117
  • Improved CWE-73 detection, resulting in a reduction in false positives

PHP​

  • PHP 8.2 and 8.3 support

Other languages​

  • Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives for all languages
  • Improved CWE-416 detection in iOS
  • Improved third-party detection in Android

March 28, 2024​

Updated language and framework support​

.NET​

  • Improved CWE-1174 flaw detection resulting in a reduction in false positives

Android​

  • Enhanced Android 14 support

Apex​

  • Improved CWE-80 flaw detection resulting in a reduction in false positives

C/C++​

  • Improved CWE-190 flaw detection resulting in a reduction in false positives
  • CentOS/RHEL 9 (x64) support

COBOL​

  • Improved parsing for COBOL

Go​

  • Go 1.22 support

Java​

  • Improved CWE-259 flaw detection for Java
  • Improved processing of shaded JAR files

JavaScript​

  • Improved processing of large JS files

Kotlin​

  • Improved source file name parsing for Kotlin results

PL/SQL​

  • Improved scan times for PL/SQL

Python​

  • Improved CWE-80 handling for Python resulting in a reduction in false positives

React Native​

  • Improved React Native handling of IPA files

T-SQL​

  • Improved CWE-89 detection for T-SQL resulting in a reduction in false positives

March 12, 2024​

Updated Pipeline Scan language support​

Pipeline Scan now supports Ruby on Rails.

February 22, 2024​

Updated language and framework support​

.NET​

  • Enhanced .NET 8 support
  • Improved support for CultureInfo.InvariantCulture
  • Improved CWE-78 flaw detection
  • Improved CWE-117 flaw detection resulting in a reduction in false positives

C/C++​

  • Improved CWE-121 flaw detection resulting in a reduction in false positives
  • Improved CWE-125, 129, 134, 170, 190, 191, 195, and 196 flaw detection
  • Improved CWE-477 flaw detection

COBOL​

  • Improved flaw analysis for CWE-78, 89, 114, 201, 209, 242, 248, 252, 489, and 798
  • Improved parsing for COBOL
  • Improved scan performance for COBOL
  • Improved scan size calculations

Java​

  • Improved CWE-80 fix detection with modern Spring Framework versions
  • Improved generic modeling and modeling of Spring Framework applications, which impacts all CWEs
  • Improved CWE-916 detection
  • Improved Java third-party detection

JavaScript and TypeScript​

  • Improved analysis for numeric and boolean datatypes, which impacts all CWEs
  • Improved type detection to prevent false positives for CWE-601 and all other CWEs
  • Detect and ignore webpack-generated files that are concatenated or minified
  • Improved support for fs/promises, which impacts all CWEs

Other languages​

  • Improved CWE-259 and 798 flaw detection resulting in a reduction in false positives for all languages
  • Improved analysis of conditionals for all languages
  • Improved CWE-89 flaw detection for Classic ASP
  • Improve support for error_log, which impacts CWE-73, 88, 93 and 117 for PHP

January 25, 2024​

Updated language and framework support​

.NET​

  • Improved third-party detection
  • Enhanced .NET 8 support
  • Improved CWE-80, 89, 404, 501, and 1174 detection

Java​

  • Improved flaw detection
  • Improved third-party detection
  • Improved CWE-117, 327, and 749 detection
  • Added ‘jsi’ filetype support

C/C++​

  • Improved flaw detection
  • Added openSUSE (x86) version 12 support
  • Improved CWE-121 and 190 detection

Dart​

  • Improved flaw detection
  • Improved third-party detection
  • Improved CWE-331 detection

Other languages​

  • Improved Android third-party detection
  • Improved JavaScript flaw detection
  • Updated JavaScript third-party detection
  • Improved CWE-99 and 918 detection for Python
  • Improved CWE-259, 798 detection for PHP
  • Improved CWE-252, 259, 311, 522, 614, and 798 detection in iOS
  • Improved CWE-321 detection for all languages
  • Added CWE-639 support for COBOL

January 18, 2024​

The Veracode CLI now supports autopackaging for Veracode Static Analysis​

The Veracode CLI now supports Static Analysis autopackaging for Java, JavaScript, and Python. The package command removes manual packaging steps to streamline your application security tests.

Previous updates​

2023 updates​

2023 updates

December 27, 2023​

New COBOL scanner for Static Analysis​

The new COBOL scanner for Veracode Static Analysis includes advanced pattern recognition and static analysis techniques, allowing for more accurate and efficient detection of security vulnerabilities in COBOL code.

The improved detection may result in the identification of additional vulnerabilities and potential threats. The updates may also impact flaw matching for your applications. If you need help resolving these changes, contact Veracode Technical Support.

All COBOL scans now use the upgraded scanner.

More details are available in the Veracode Community.

December 14, 2023​

Updated language and framework support​
  • Added .NET 8 initial support
  • Added JavaScript / ECMAScript 2023 (ES14) support
  • Added Config support from AWS SDK for Go
  • Enhanced Android 13 support
  • Enhanced Node.js v20 support
  • Added Dart 3.2 and Flutter 3.16 support
  • Improved CWE-327 (Use of Broken or Risky Cryptographic Algorithm) and CWE-352 (Cross-Site Request Forgery (CSRF)) detection for Ruby on Rails
  • Improved CWE-566 (Authorization Bypass Through User-Controlled SQL Primary Key) detection for .NET
  • Improved CWE-352 (Unchecked Return Value) and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) detection for .NET
  • Improved accuracy of modeling Python method calls resulting in a reduction in false positives
  • Improved CWE-926 (Improper Export of Android Application Components) detection for Android
  • Improved CWE-321 (Use of Hard-coded Cryptographic Key) detection for all languages
  • Improved CWE-331 (Insufficient Entropy) detection for Java
  • Improved CWE-601 (URL Redirection to Untrusted Site ('Open Redirect')) detection for PHP
  • Improved parsing for PL/SQL
  • Improved Python jsonify cleanser support for flaw class CWE-80 (Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS))
  • Improved support for JavaScript crypto APIs
  • Improved iOS detection of CWE-252 (Unchecked Return Value)
  • Improved support for JavaScript Axios library
  • Improved .NET third-party detection
  • Improved mixed-Java/Kotlin analysis
  • Improved Java third-party detection
  • Improved Android version detection
  • Improved CWE-326 (Inadequate Encryption Strength) accuracy in .NET
  • Improved accuracy for CWE-259 (Use of Hard-coded Password)and CWE-798 (Use of Hard-coded Credentials)
  • Added detection of CWE-489 (Active Debug Code) in Go
  • Improved analysis of JavaScript listeners

November 15, 2023​

Updated language and framework support​
  • Added Javax to Jakarta transition support
  • Added support for Java Records
  • Added Spring Boot 3 support
  • Added Spring Security 6 support
  • Added Spring Core 6 support
  • Added Android 14 Initial support
  • Added KMS support for AWS SDK for Go
  • Improved flaw detection for Dart apps
  • Improved CWE-259 (Use of Hard-coded Password) and CWE-798 (Use of Hard-coded Credentials) detection for all languages
  • Improved CWE-1174 (ASP.NET Misconfiguration: Improper Model Validation), CWE-352 (Cross-Site Request Forgery), and CWE-915 (Improperly Controlled Modification of Dynamically-Determined Object Attributes) detection for .NET
  • Improved third-party detection for Android, C/C++, Dart, and JavaScript
  • Improved CWE-73 (External Control of File Name or Path) detection for Java
  • Improved third-party detection in Java WAR files
  • Improved CWE-252 (Unchecked Return Value), CWE-201(Insertion of Sensitive Information Into Sent Data), and CWE-297 (Improper Validation of Certificate with Host Mismatch) detection for iOS
  • No longer report MemoryStream for CWE-404 in .NET
  • Improved detection for unsupported mobile applications

October 26, 2023​

Updated language and framework support​
  • Added Dart 3.1 and Flutter 3.13 support
  • Added JDK 21 (LTS) support
  • Improved CWE-259 (Use of Hard-coded Password) and CWE-798 (Use of Hard-coded Credentials) detection for Kotlin
  • Improved .NET analysis to ignore .NET ClickOnce “.deploy” files
  • Improved third-party detection for Java, JavaScript, PHP, iOS, PL/SQL and C++
  • Improved parsing for PL/SQL
  • Improved CWE-798 (Use of Hard-coded Credentials) detection for PHP
  • Enhanced Python analysis to treat modules consisting of all third-party code as first-party modules
  • Improved Groovy analysis of objects
  • Improved CWE-252 (Unchecked Return Value) detection for iOS
  • Improved JavaScript analysis of objects
  • Improved analysis of iOS apps to reduce CWE-284 (Improper Access Control) false positives
  • Improved CWE-693 (Protection Mechanism Failure), CWE-926 (Improper Export of Android Application Components), CWE-327 (Use of a Broken or Risky Cryptographic Algorithm) and CWE-798 (Use of Hard-coded Credentials) detection for Android

October 2, 2023​

Updated language and framework support​
  • Added iOS 17 initial support
  • Added Go 1.21 support
  • Added PHP Laravel 10 support
  • Added .NET Minimal API support
  • Enhanced .NET 7 support
  • Enhanced Groovy 3 support
  • Enhanced AWS SDK for Go support
  • Enhanced Android 13 support
  • Improved third-party detection for JavaScript
  • Improved CWE-80 detection for Vue.js
  • Improved CWE-259 detection for all languages
  • Improved CWE-89 detection for Transact-SQL
  • Improved third-party detection for C++
  • Improved symmetric-key parsing rules for Transact-SQL
  • Improved attribute idiomatic transformation support for Jakarta
  • Improved CWE-693 detection for Android
  • Improved scan performance for Micronaut framework
  • Improved Node.js modeling to reduce false positives
  • Improved handling of explicitly typed generic function calls in Go
  • Improved data path quality for JavaScript
  • Improved reporting of CWE-352 and CWE-915 in .NET to consolidate flaws reported on the same line and file as separate flaws into one flaw
  • Added CWE-566 (Authorization Bypass Through User-Controlled SQL Primary Key) detection for .NET applications
Deprecated support for some .NET cleansing functions​

Veracode has deprecated support of .NET cleansers for the following functions for flaw classes CWE-93, CWE-113, and CWE-117:

  • antixsslibrary.dll : Microsoft.Security.Application.AntiXss.HtmlAttributeEncode
  • antixsslibrary.dll : Microsoft.Security.Application.AntiXssEncoder.HtmlAttributeEncode
  • antixsslibrary.dll : Microsoft.Security.Application.Encoder.HtmlAttributeEncode
  • antixsslibrary.dll : Microsoft.Security.Application.Encoder.HtmlEncode
  • mscorlib.dll : System.Security.SecurityElement.Escape
  • system.dll : System.Net.WebUtility.HtmlEncode
  • system.web.dll : System.Web.HttpServerUtility.HtmlEncode
  • system.web.dll : System.Web.Security.AntiXss.AntiXssEncoder.HtmlEncode
  • system.web.dll : System.Web.Util.HttpEncoder.HtmlAttributeEncode
  • system.web.dll : System.Web.Util.HttpEncoder.HtmlEncode
  • system.web.mvc.dll : System.Web.Mvc.HtmlHelper.AttributeEncode
  • system.web.mvc.dll : System.Web.Mvc.HtmlHelper.Encode
  • system.windows.browser.dll : System.Windows.Browser.HttpUtility.HtmlEncode
  • system.windows.dll : System.Net.HttpUtility.HtmlEncode
  • System.Runtime.dll : System.Net.WebUtility.HtmlEncode

These cleansing functions are insufficient for addressing their targeted flaw classes and better alternatives are available.

For more details on why Veracode deprecated support for these functions and how to protect your applications against CRLF injection attacks, see the Veracode Community.

September 11, 2023​

Fixed bug causing false positives for CWE-798​

In last month’s release, Veracode added improved support for CWE-798 (Use of Hard-coded Credentials) detection. However, a bug in the pattern matching caused a significant number of false positives for some users. Veracode has resolved this issue and the improvement should result in significantly fewer CWE-798 false positives.

August 23, 2023​

Updated language and framework support​
  • Added Kotlin 1.9 support
  • Added TypeScript 5.x support
  • Added GCC 12 (RHEL 8) support
  • Improved CWE-1174 (ASP.NET Misconfiguration: Improper Model Validation) detection on controller-derived classes
  • Improved support for JavaScript URLSearchParams API
  • Improved support for Spring produces annotation attribute
  • Improved third-party detection for JavaScript
  • Improved third-party detection for Android
  • Improved third-party detection for Java
  • Improved hardcoded password/credential detection (CWE-259 and 798)
  • Improved .NET CWE-80 basic XSS detection
  • Improved JavaScript detection of document elements
  • Improved performance for Vue applications
  • Improved .NET Entity Framework support
  • Added ability to allow third-party PHP software if the entire upload is third-party
  • Improved detection of Java CWE-611 XXE
  • Improved support for Python Django views

July 25, 2023​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has added support for Quarkus, a Kubernetes-native Java stack tailored for OpenJDK HotSpot and GraalVM.

Veracode has improved static analysis by adding support for these new versions of supported technologies:

Improved Detection of CWE-259 and CWE-798​

Improvements to the detection methods Veracode uses to identify CWE-259 (Use of Hard-coded Password), and CWE-798 (Use of Hard-coded Credentials) vulnerabilities should reduce the number of false positives during static analysis. Improved CWE-259 coverage for Python language submissions.

June 22, 2023​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has added support for Micronaut 3.8.x, which is a JVM-based framework you use to build lightweight, modular applications.

Veracode has improved static analysis by enhancing support for Android 12.

Veracode has improved static analysis by adding support for these new versions of supported technologies:

Improved CWE-259 (Use of Hard-coded Password) and CWE-798 (Use of Hard-coded Credentials) Detection​

Improvements to the detection methods utilized to identify CWE-259 and CWE-798 vulnerabilities should reduce the number of false positives found during static analysis.

Additional CWE-693 Coverage for Android​

Veracode has added an additional CWE-693 (Protection Mechanism Failure) check for Android applications to ensure that the Play Integrity API is used appropriately.

May 23, 2023​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode improved static analysis by adding support for these new versions of supported technologies:

Improved CWE-89 Coverage for Java and JavaScript/TypeScript​

The improved coverage increases the number of potential CWE-89 flaws that Veracode discovers in Java and JavaScript/TypeScript applications, which might affect your scan results.

Added CWE-451 Coverage for Android​

Veracode has added CWE-451 (Tapjacking) coverage for Android applications.

May 18, 2023​

Pipeline Scan Adds Support for Module Selection​

Pipeline Scan adds a new --include parameter. You use this parameter to specify the top-level modules to include during scanning. The scan results now show both the modules that Veracode identified during prescan and the modules included in the scan.

This update is available with Veracode CLI version 23.4.3-0 and Veracode Docker image version 23.4.3.

April 27, 2023​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode improved static analysis by adding support for these new versions of supported technologies:

Improved Static Analysis for Python Language Submissions​

Static analysis of Python applications inaccurately reports certain CWE-918 (Server-Side Request Forgery (SSRF)) flaws as CWE-201 (Insertion of Sensitive Information Into Sent Data) flaws. This update recategorizes these incorrectly reported flaws as CWE-918. This update might impact existing flaw matching and you might need to apply new mitigations to these flaws.

After you apply this update, any Python applications that contain CWE-201 flaws and have any of the following policy requirements might fail your security policy:

  • Security Standard rule for Auto-Update CWE Top 25

  • Findings by Severity rule for Medium or higher

  • Minimum Scan Score rule

March 23, 2023​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode improved static analysis by adding support for these new versions of supported technologies:

Improved Static Analysis for WebMethodAttribute use in ASP.NET Classic​

Veracode has improved static analysis for WebMethodAttribute use in ASP.NET Classic (non MVC and/or MVC Core) WebForms and WebServices. This will affect the flaws found and associated policy results for customers by reducing the number of FPs found.

February 23, 2023​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode improved static analysis by adding support for these new versions of supported technologies:

Improved COBOL Parser Error Handling​

Veracode no longer reports parser errors in standalone copybook files that COBOL files do not include. These files are not relevant for security scanning unless COBOL files reference them.

January 26, 2023​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode improved static analysis by adding support for these new versions of supported technologies:

Veracode has improved static analysis by adding support for:

  • Server-side request forgery (SSRF) reporting for JavaScript

Veracode has released a new version of our new iOS packaging tool:

  • Gen IR version 0.2.1: gen-ir

2022 updates​

2022 updates

December 15, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode improved static analysis by adding support for these new versions of supported technologies:

Veracode improved static analysis by adding support for these new languages and frameworks:

Veracode has improved static analysis by adding a new iOS packaging tool to support Xcode 14 without the Enable_Bitcode setting:

November 17, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode improved static analysis by adding support for these languages and frameworks:

October 27, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode improved static analysis by adding support for these languages and frameworks:

October 19, 2022​

New Packaging Guidance Tool​

You can use the new Veracode Packaging Cheat Sheet to generate language-specific packaging guidance for Static Analysis.

October 4, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode improved static analysis by adding support for these languages and frameworks:

August 25, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has improved static analysis by adding:

August 1, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has improved static analysis by adding:

June 24, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has improved static analysis by adding:

April 28, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has improved static analysis by adding:

March 28, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has improved static analysis by adding:

February 24, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has improved static analysis by adding:

Veracode has improved static analysis by adding support for these new versions:

February 3, 2022​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has improved static analysis by adding:

Veracode has improved static analysis by adding support for these new versions:

Veracode Static Analysis Improvements​

Veracode has improved accuracy of hard-coded Passwords. You can expect:

  • Fewer false positives where local files are in known valid locations
  • Better identification of sensitive variable names

Veracode has improved modeling for TypeScript support. You can expect:

  • Fewer false positives, and more true positives in TypeScript applications where type information is specified.

2021 updates​

2021 updates

December 20, 2021​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has improved static analysis by adding support for:

  • Azure Functions used in .NET
  • Thymeleaf templates for Spring Boot
Veracode has improved static analysis by adding support for these new versions:​
  • Initial support of .NET 6.0
  • Initial support of Android 12

November 18, 2021​

New Veracode Static Analysis Support​

Veracode has improved static analysis by adding:

  • Full support for JDK 17
  • Full support for ColdFusion 2016

October 21, 2021​

New Veracode Static Analysis Support​
  • Veracode has improved static analysis by adding support for Apex 52.0.
Improved Veracode Static Analysis Support​
  • Veracode has further improved its accuracy in its detection of hard-coded credentials in applications. You might see a decrease in false positives related to hard-coded credentials.

October 20, 2021​

Veracode European Region now available ​

The Veracode European Region is now available for new customers. This region, which initially supports Veracode Static Analysis and Veracode Software Composition Analysis, provides European data residency for Veracode customers.

September 28, 2021​

New Veracode Static Analysis Support​

Veracode has improved static analysis by adding:

  • Initial support for iOS 15
  • Full support for .NET 5.0
Improved Veracode Static Analysis Support​
  • Veracode has improved its detection of hard-coded passwords in applications. You might see an increase in findings related to hard-coded passwords.

August 26, 2021​

New Support for GCC 10 on Red Hat Enterprise Linux 8​
  • Veracode has improved static analysis by adding support for the GCC 10 compiler on Red Hat Enterprise Linux.
Improved Static Analysis Support​

Veracode has made several improvements to static analysis, including:

  • Prevention of reporting hard-coded credentials for variables related to mock libraries
  • Prevention of reporting hard-coded credentials for nonsensitive data in JavaScript dictionaries
  • Improved recognition of password keywords in concatenated strings
  • Improved heuristics to identify potentially sensitive data

July 22, 2021​

New Veracode Static Analysis Support​
  • Veracode has improved static analysis by adding support for Angular 12 applications.
Improved Veracode Static Analysis Results​
  • Veracode has improved static analysis for Node.js 13 and 14 applications.

June 16, 2021​

Pipeline Scan Supports Uploading Larger Files​
  • Veracode Pipeline Scan now supports the analysis of applications up to 200 MB.

June 2, 2021​

New Veracode Static Analysis Support​

Veracode has improved static analysis by adding support for these new technologies:

  • Initial Support of Java 16
  • tvOS
Compatibility Updates for iOS and tvOS Application Packager​
  • Veracode has improved the mobile application packager used for preparing iOS and tvOS applications to support the latest versions of macOS. This update also includes several usability improvements based on user feedback.
New Distribution Method for the Ruby Gem Packager​
  • Veracode began distributing the Gem file required for preparing Ruby on Rails applications. For the latest updates to the Gem file, retrieve the file from rubygems.org using these Veracode instructions.

May 3, 2021​

New Veracode Static Analysis Support​
  • Veracode has improved static analysis by adding support for AWS SDK for .NET.
Improved Veracode Static Analysis Results​
  • Veracode has improved static analysis of Java applications by identifying additional security flaws related to deserialization vulnerabilities.

April 6, 2021​

Improved Veracode Static Analysis Support for Android Applications​
  • Veracode has improved static analysis of Android applications by adding support for Android applications packaged as Android App Bundles (AAB).

April 1, 2021​

Deprecated Support for Older Versions of Veracode Pipeline Scan​

  • On April 1 2021, Veracode will no longer support versions of pipeline-scan.jar that you have downloaded before September 2020. These versions are 20.9.1 and earlier. To identify the version of the pipeline-scan.jar that you are using, you can run it with the --version option at the command line.

  • To transition to a supported version of the JAR file, replace the version that you are using with the latest one, which you can download here: https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip Veracode also provides Pipeline Scan as a Docker image on ##### Docker Hub](https://hub.docker.com/r/veracode/pipeline-scan).

  • Updating to the latest version of pipeline-scan.jar ensures that you are working with the latest version of the Veracode software, which includes many new features and bug fixes.

March 31, 2021​

New Veracode Static Analysis Support​
  • Veracode has improved static analysis by adding support for Blazor WebAssembly for.NET applications.
Improved Veracode Static Analysis Results​
  • Veracode has improved static analysis of .NET Core 3.1 applications.
Remediation Guidance Added to Pipeline Scan Results​
  • The Pipeline Scan results now include links to the Veracode Knowledge Base, which provides suggestions for remediating issues.

March 2, 2021​

New Veracode Static Analysis Support for Languages and Frameworks​

Veracode has improved static analysis by adding support for these new versions of supported technologies:

  • Transact-SQL 15.x
  • Ember.js 3.x for JavaScript

Veracode has improved static analysis by adding initial support for these versions of supported technologies:

  • .NET 5
  • Kotlin 1.4
  • Groovy 3
Improved Veracode Static Analysis Support for iOS​
  • Veracode has provided additional security checks for applications built using iOS 14. You may see additional findings for applications as a result of these improvements.
Improved Results for Cryptography Findings for Java Applications​
  • Veracode has improved static analysis of Java applications by updating the list of acceptable cryptography algorithms.

February 4, 2021​

New Veracode Static Analysis Support​

Veracode has improved static analysis by adding support for these new technologies:

  • C++ applications built with GCC 9 on RedHat 8
  • Koa.js version 2.13
  • Hibernate framework version 5
  • Autofac framework. Static analysis of .NET applications that use Autofac may report additional findings as a result of these improvements.
Improved Veracode Static Analysis Results​

Veracode provides these improvements for supported technologies:

  • Additional security checks for applications built using functions specific to Android 10. You may see additional findings for applications as a result of these improvements.
  • Enhanced accuracy of scan results of PHP and Python applications. The scan results now provide more emphasis on custom first-party components rather than third-party libraries.
Improved Prescan Warning Messages​

  • Veracode has improved warning messages to identify applications that do not meet Veracode packaging requirements.

  • Veracode has also improved the accuracy of warning messages for several languages and file types by providing more descriptive error resolution recommendations.

Improved Results Consistency for Java Applications​

  • Veracode has improved static analysis of Java web applications packaged as WAR and EAR files. Veracode provides more consistent results between subsequent scans and more accurately recognizes first-party components in the applications.

  • You may notice a one-time change to scan results as a result of this improvement.

Improved Results Accuracy Within JSP Files​
  • Veracode has improved static analysis of JSP applications to prevent static analysis from reporting duplicate flaws.

January 12, 2021​

Compilation Guide Renamed​
  • To more accurately describe its contents, the Compilation Guide is now called Veracode Packaging Requirements.

January 7, 2021​

Pipeline Scan Integration with Veracode Security Policies​
  • Veracode has improved the Pipeline Scan to support the use of policy rules defined in the Veracode Platform. This enhancement allows you to assess applications against consistent rules for pass or fail.

2020 updates​

2020 updates

December 17, 2020​

New Veracode Pipeline Scan Support for PHP Applications​
  • Veracode has improved the Pipeline Scan by adding support for PHP applications.

December 15, 2020​

New Support for Languages and Frameworks​

Veracode has improved static analysis by adding support for these new versions of supported technologies:

  • Android 11
  • C++ Support for Red Hat Enterprise Linux 8
  • Grails 4
  • Java 15
  • Slick Library for Scala
Improved Support for Java​
  • Veracode has improved static analysis of Java applications by adding support for JNDI injection flaws. See the Veracode blog post for details about these types of flaws.
Improved Prescan Warning Messages​

  • Veracode has improved its warning messages to notify you when the JavaScript and TypeScript files you submit have parsing errors. Parsing errors can affect the quality of the prescan results.

  • Veracode has also improved the accuracy of warning messages for several other languages and file types.

Simplified Packaging Requirements for iOS Applications​
  • Veracode has improved the user experience of analyzing iOS applications by simplifying the requirements for packaging.

November 24, 2020​

New Support for GCC 8.3 on Red Hat Enterprise Linux 7​
  • Veracode has improved static analysis by adding support for the GCC 8.3 compiler on Red Hat Enterprise Linux.

October 30, 2020​

New Pipeline Scan Support for React Native, Titanium, and Cordova Applications​
  • Veracode has improved the Pipeline Scan by adding support for React Native, Titanium, and Cordova applications.

October 29, 2020​

Improved Veracode Static Analysis Results​

Veracode has improved static analysis of these supported technologies:

  • Angular templates
  • Apache Commons
  • AWS SDK for Java
  • JavaScript
  • Python

New Pipeline Scan Reporting Options:

  • Veracode has improved the Pipeline Scan to support reporting a filtered list in JSON format of issues that caused the analysis to fail.

October 21, 2020​

Pipeline Scan Supports Custom GitLab Domains​
  • Veracode has improved the Pipeline Scan to support custom GitLab domains when creating GitLab issues.

October 6, 2020​

Improved Pipeline Scan Error Messages and Logging​

Veracode has improved pipeline scans to include these enhancements:

  • Improved error message content
  • Integration with Log4j to log debug messages

October 2, 2020​

New Pipeline Scan Support for Python Applications​
  • Veracode has improved Pipeline Scan to include support for Python applications.

September 26, 2020​

Packaging Improvements for .NET Applications​
  • Veracode has improved the user experience of analyzing .NET applications by adding support for .NET applications submitted as standard NuGet packages.

September 24, 2020​

New Pipeline Scan Support​
  • Veracode has improved Pipeline Scan to include support for Android applications.
New Veracode Static Analysis Support​

Veracode has added support for new versions of these technologies:

  • Angular 9 and 10
  • Visual Studio 2019 for Visual C++
Improved Veracode Static Analysis Support​

  • Veracode has improved static analysis of AWS SDK for JavaScript.

  • Veracode has improved static analysis of .NET and JVM-based applications. Veracode reduced the number of prescan warning messages that it sends for components that are common third-party libraries.

September 17, 2020​

New Static Analysis Support for iOS 14​
  • Veracode has improved static analysis by adding initial support for iOS 14.

September 1, 2020​

New Veracode Static Analysis Support​

Veracode has added static analysis support for these technologies:

  • React Native 0.6x
  • Ruby on Rails 6
  • Jinja2 Template Library for Python
Veracode Static Analysis Recognized Cleansers​

As a result of updated security research, Veracode has added several CRLF cleansing functions to the list of supported cleansing functions. Veracode also removed these CRLF functions:

  • com.google.gwt.safehtml.shared.SafeHtmlUtils.htmlEscape
  • com.google.gwt.safehtml.shared.SafeHtmlUtils.htmlEscapeAllowEntities
  • com.google.gwt.safehtml.shared.SafeHtmlUtils.fromString
  • org.springframework.web.util.HtmlUtils.htmlEscape
  • org.springframework.web.util.HtmlUtils.htmlEscapeDecimal
  • org.springframework.web.util.HtmlUtils.htmlEscapeHex
  • org.apache.axis.components.encoding.XMLEncoder.encode
  • com.liferay.portal.kernel.util.HtmlUtil.escapeAttribute
  • com.liferay.portal.kernel.util.HtmlUtil.escape
  • com.liferay.portal.kernel.util.HtmlUtil.escapeHREF
  • com.liferay.portal.kernel.util.HtmlUtil.escapeXPath
Improved Veracode Static Analysis User Experience​

Veracode has improved the user experience of static analysis by providing:

  • More consistent naming for the submitted components
  • More information added to some prescan error messages

August 7, 2020​

New Pipeline Scan REST APIs​
  • The new Pipeline Scan REST APIs allow you to submit pipeline scans directly using an API.
Pipeline Scan Improvements​

Veracode Static Analysis using pipeline scanning includes these enhancements:

  • New command parameters for creating GitLab issues and vulnerabilities from scan output:
    • --gl_issue_generation
    • --gl_vulnerability_generation
  • New GitLab examples added to the pipeline scan README and the Veracode Help Center

July 10, 2020​

New Pipeline Scan Support for .NET Applications​
  • Veracode has added pipeline scan support for .NET applications.

July 1, 2020​

New Veracode Static Analysis Support​

Veracode has added static analysis support for these technologies:

  • AWS SDK for
  • Ruby 2.6 and 2.7
  • AcuCOBOL-GT 10.3
  • Xcode 11.5
Improved Veracode Static Analysis Support​

Veracode has improved static analysis of these technologies:

  • AWS SDK for Python (Boto3).
  • Additional security checks for applications built using Java 12, 13, and 14. You may see additional findings for applications as a result of these improvements.
  • Additional security checks for applications built using .NET Core 3.1. You may see additional findings for applications as a result of these improvements.
  • Additional security checks for applications using Apache Commons libraries. You may see additional findings for applications as a result of these improvements.
  • Additional security checks for applications using Go templates. You may see additional findings for applications as a result of these improvements.
  • Improved scan coverage for iOS application submissions. Veracode now analyzes all components submitted with an iOS application, including standalone frameworks, extensions, and watchOS extensions. After a prescan, you can select these components from a list of modules.
New Video - Review Static Analysis Flaws​

This video shows you how to:

  • Access static flaw information in the Triage Flaws view of the Veracode Platform.
  • Use the Source Code view to load source code from your local system into the Triage Flaws page so that you can view information about the flaw in the context of your original source.
  • Document a proposed mitigation for review.

June 13, 2020​

New Veracode Static Analysis Support​

Veracode has added static analysis support for these technologies:

  • Improved analysis of Go applications by adding support for the Gorilla framework, and improving overall results quality.
  • Improved analysis of JavaScript applications using AWS Lambda and other functions by adding support for the AWS SDK.
Improved Veracode Static Analysis Support​

Veracode has improved static analysis of these technologies:

  • Improved static analysis of iOS applications by improving the results of scans, to better focus the results on custom first-party components, instead of third-party libraries.
  • Improved static analysis of .NET and Java applications to more accurately report the analysis size of dependent modules. These changes may result in smaller reported sizes for scan submissions.
  • Veracode now reads the contents of the go.mod file included in an application submission to more accurately identify which Go components to analyze.

May 13, 2020​

Pipeline Scan Improvements​

Veracode Static Analysis using pipeline scanning includes these enhancements:

  • New command parameters for storing information about the application you are scanning:
    • --app_id
    • --development_stage
  • New code examples that show how to integrate a pipeline scan with GitHub actions and Azure DevOps. These examples are included in both the pipeline scan Readme file and the Veracode Help Center.

May 4, 2020​

New Veracode Static Analysis Support​

Veracode now supports static analysis of these libraries for Apex:

  • Visualforce
  • Lightning
  • Aura components for Salesforce
Improved Veracode Static Analysis Support​

Veracode now supports static analysis of these technologies:

  • Apex version 49.
  • Java applications built on Java 14.
  • Version 2.6 and 2.7 of the Play framework for Scala. You may see additional findings for Play applications as a result of these improvements.
  • Python application analysis improvements, including additional security checks for risks related to certificate management and cryptography settings. You may see additional findings for Python applications as a result of these improvements.
  • Updated CWE definitions for flaws that had been reported previously as CWE 100 and 391. MITRE is deprecating these CWEs. MITRE is recategorizing CWE 100 flaws as CWE 1174, and recategorizing CWE 391 flaws as either CWE 252 or CWE 273, depending on the details of the flaw.

Veracode has updated policy rules that included entries for CWE 100 and CWE 391 to include the new CWEs.

After you run the next scan of affected applications, the Veracode Platform reports and analytics reflect the new CWE values. Data for previous scans still include the historical values.

April 23, 2020​

Improved Veracode Static Analysis Support with Pipeline Scanning​

Veracode static analysis using pipeline scanning now includes these features:

  • Support for Scala, Kotlin, and Groovy applications
  • Veracode authentication using the API credentials file
  • Human user accounts with the required user roles can run pipeline scans

April 14, 2020​

New Video - Run a Pipeline Scan in Your CI/CD Environment​
  • This video shows you how the pipeline scan runs directly within a CI/CD environment.

April 2, 2020​

New Veracode Static Analysis Support​
  • Veracode has improved static analysis by adding support for AWS Lambda functions for Java, .NET, Node.js, and Python.

#####Improved Veracode Static Analysis Support

Veracode has improved static analysis of these technologies:

  • Improved results quality for iOS 13 applications
  • Support for iOS applications built with Xcode 11.4

Veracode has changed reporting of CWE 404 flaws to be more specific about where they occur, which may result in additional findings. Veracode has also changed the severity of CWE 404 to Informational.

March 16, 2020​

Announcing General Availability of Pipeline Scan for Veracode Static Analysis​
  • Veracode is pleased to announce the general availability release of the pipeline scan, a purpose-built tool for DevOps engineers. The pipeline scan directly embeds into your CI tools and provides fast feedback on flaws after each commit.

February 20, 2020​

New Veracode Static Analysis Support​
  • Veracode has improved static analysis by adding support for a new version of Visual C++ applications built for Windows 10, Server 2016, and Server 2019.
Improved Veracode Static Analysis Support​

Veracode has improved static analysis of these supported technologies:

  • Apache Struts 2
  • Safe cryptography libraries in PHP
  • Apex triggers submitted with the TGR file extension

January 30, 2020​

New Veracode Static Analysis Support​

Veracode has improved static analysis by adding support for these new versions of supported technologies:

  • Java applications built on Java 13
  • Initial support for .NET Core 3.1
Improved Veracode Static Analysis Support​

Veracode has improved static analysis of these supported technologies:

  • APIs and language features specific to .NET Core 3.0, .NET Standard 2.1, and C# 8. You may see additional findings in .NET applications that use these new features.
  • log4net, Serilog, and NLog logging technologies in .NET for detecting log injection flaws in .NET applications. You may see additional findings in .NET applications that use these technologies.
  • Additional security checks for Android 9 applications. You may see additional findings for Android applications as a result of these improvements.
]]> <![CDATA[Training updates]]> https://docs.veracode.com/updates/r/c_all_training 2026-10-07T00:00:00.000Z The updates on this page apply to Veracode Security Labs and Veracode eLearning. Subscribe to the Training updates RSS feed Feed-icon.png.

Updates that apply to specific Veracode regions show a region icon. Security Labs is only available in the Commercial region .

eLearning is available in all Veracode regions.

October 7, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

  • OWASP LLM 10: Out of Control (Flask)

September 29, 2026​

Select team availability in Security Labs​

If your organization has more than 500 teams, you can now select which teams are available for use in Security Labs.

September 10, 2026​

Veracode eLearning REST API has reached end of support​

We will no longer update this API or provide technical support.

September 9, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

  • OWASP LLM 09: Outdated Answers (Flask)

August 13, 2026​

Date range for eLearning reports​

You can now select a start date of up to one year in the past for an eLearning report.

August 6, 2026​

New Security Labs lessons

OWASP Top 10 for LLM applications​

  • OWASP LLM 08: Vectors Without Borders (Flask)

OWASP Top 10:2025 labs​

  • OWASP 1: Bad Cookie (Java)

July 8, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

  • OWASP LLM 07: Under the Hood (Flask)

Updated eLearning course

The following course is now available with English, Spanish, French, Portuguese, and Chinese captions.

  • C/C++ Memory Management Risks and Best Practices

June 30, 2026​

Deprecation notice: Security Labs community edition​

The Security Labs community edition will be deprecated on July 31, 2026.

June 10, 2026​

Security Labs updates

The deprecated OWASP Top 10 (2021) lessons are no longer available. The following lessons have been added.

OWASP Top 10 for LLM applications​

  • OWASP LLM 06: The Chaos Creator (Flask)

OWASP Top 10:2025 labs​

  • OWASP 1: Loose Lips Sink Servers (Java)

eLearning course updates

The following 33 deprecated courses are no longer available, and certification levels have been updated to include newer courses.

  • OWASP 2017
  • OWASP Top 10 (2021) (6 courses)
  • Secure Coding for .NET (6 courses)
  • Secure Coding for Java (6 courses)
  • Secure Coding for JavaScript (5 courses)
  • Secure Coding for PHP (6 courses)
  • Secure Coding for Python (3 courses)

The following courses, when combined with Secure Coding Foundations, replace the deprecated courses. They are now available with English, Spanish, French, Portuguese, and Chinese captions.

  • Software Security Awareness - OWASP Top 10:2025
  • Secure coding for .NET - OWASP Top 10:2025
  • Secure coding for Java - OWASP Top 10:2025
  • Secure coding for JavaScript - OWASP Top 10:2025
  • Secure coding for PHP - OWASP Top 10:2025
  • Secure coding for Python - OWASP Top 10:2025

The following course is now available with English, Spanish, French, Portuguese, and Chinese captions.

  • Introduction to PCI DSS for Developers (v4.0.1)

May 6, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

  • OWASP LLM 05: The Trust Trap (Flask)

April 21, 2026​

Security Labs – updates to the Get Lesson Progress API​

The updated Get Lesson Progress API:

  • Has stack added to the response.
  • Shows Not Started when both start_time and end_time are null.
  • Has the updatedAfter parameter to support incremental loads.
  • Has the excludeNotStarted=true parameter to remove lessons that have not been started.
  • Includes updated_on in the response.

April 16, 2026​

Search teams in Security Labs​

In Security Labs, Security Labs administrators and managers can now search teams.

April 8, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

  • OWASP LLM 04: Hidden Triggers (Flask)

March 23, 2026​

Security Labs users and teams is integrated with the Veracode Platform​

Security Labs users and teams can now be managed by the Veracode Administrator and the Team Admin from the Veracode Platform. Learning for users and teams in the Veracode Platform is managed from Security Labs. This change involves Veracode authenticating Security Labs users through Veracode IAM (Identity and Access Management).

Customers are migrated to this feature in phases. After migration, Security Labs users sign in to the Veracode Platform and access Security Labs under Security Training. If you wish to enable this feature, please contact support@veracode.com.

Note

Customers using Security Labs from the European Region are not migrated to this feature at this time.

March 4, 2026​

New Security Labs lesson

OWASP Top 10 for LLM applications​

  • OWASP LLM 03: Code at Your Command (Flask)

New eLearning courses

Secure coding language addendum courses​

Secure coding courses with language examples have been added, to align with the latest OWASP Top 10:2025. Courses that follow the 2021 list will be deprecated in June 2026.

  • Software Security Awareness - OWASP Top 10:2025
  • Secure coding for .NET - OWASP Top 10:2025
  • Secure coding for Java - OWASP Top 10:2025
  • Secure coding for JavaScript - OWASP Top 10:2025
  • Secure coding for PHP - OWASP Top 10:2025
  • Secure coding for Python - OWASP Top 10:2025

March 3, 2026​

Security Labs - URL change and terminology update​

The default URL to access Security Labs has changed from https://securitylabs.veracode.com/ to https://securitylabs.veracode.com/security-labs/. Customers who access Security Labs with a stand‑alone account through their organization’s single sign-on (SSO) should update the Security Labs URL for continued access to Security Labs.

In Security Labs, Teams are now called Organizations, and Roles are called Teams.

February 5, 2026​

New Security Labs lessons

OWASP Top 10 for LLM applications​

  • OWASP LLM 01: From Image to Insight (Flask)
  • OWASP LLM 02: The Oversharing Assistant (Flask)

January 7, 2026​

After February 2026, the OWASP Top 10 Web Application Security Labs based on the 2021 list will be deprecated. The new OWASP Top 10:2025 labs are now available.

OWASP Top 10 2025 labs​

See the Course Catalog for more details.

  • A01 Broken Access Control
  • A02 Security Misconfiguration
  • A03 Software Supply Chain Failures
  • A04 Cryptographic Failures
  • A05 Injection
  • A06 Insecure Design
  • A07 Authentication Failures
  • A08 Software or Data Integrity Failures
  • A09 Security Logging and Alerting Failures
  • A10 Mishandling of Exceptional Conditions

As you can see from the OWASP Top 10:2025 page, there are two new categories in positions A03 and A10. Two new Security Labs lessons in these categories are:

  • OWASP 3: Letting Go of the Outdated (Java)
  • OWASP 10: Fail Securely (Java)

December 24, 2025​

In-app help in Security Labs​

In-app guidance is now available for creating campaigns and using reporting in Security Labs.

Note: For in-app guidance to function, third-party cookies must be enabled in Chrome, Edge, Firefox, Safari and Internet Explorer 9+.

December 18, 2025​

Obsolete secure coding courses are being deprecated and an updated framework for secure coding training is provided.

Obsolete Secure Coding courses deprecation​

After January 2026, the following Secure Coding courses will be deprecated:

  • Secure Coding for .NET
  • Secure Coding for Java
  • Secure Coding for JavaScript
  • Secure Coding for PHP
  • Secure Coding for Python

Updated framework for secure coding training​

In the future, secure coding training will require learners to complete all seven courses in Secure Coding Foundations and one of the following OWASP Top 10 courses:

  • Secure Coding for .NET - OWASP Top 10 (2021)
  • Secure Coding for Java - OWASP Top 10 (2021)
  • Secure Coding for JavaScript - OWASP Top 10 (2021)
  • Secure Coding for PHP - OWASP Top 10 (2021)
  • Secure Coding for Python - OWASP Top 10 (2021)

October 15, 2025​

New eLearning courses

Assessment quiz courses​

Assessment quiz courses based on product learning paths are available in English, Portuguese, and Spanish.

  • User and application setup - Skills assessment
  • Static Analysis - Skills assessment
  • Dynamic Analysis - Skills assessment
  • Scan and fix in your IDE - Skills assessment
  • SCA agent-based scanning - Skills assessment

Secure coding language addendum courses​

Courses on OWASP Top 10 (2021) are available in English, Portuguese, and Spanish.

  • Secure coding for .NET - OWASP Top 10 (2021)
  • Secure coding for Java - OWASP Top 10 (2021)
  • Secure coding for JavaScript - OWASP Top 10 (2021)
  • Secure coding for PHP - OWASP Top 10 (2021)
  • Secure coding for Python - OWASP Top 10 (2021)

October 8, 2025​

New Security Labs lessons

OWASP Top 10 2021 labs​

  • OWASP 8: Mongo: like SQL, but messier (Java, .NET)
  • OWASP 8: User-Provided Users (Java, Node)

September 3, 2025​

New Security Labs lessons

Container Security in Docker - Inventory​

  • Scanning

Container Security in Docker - Orchestration​

  • Compose
  • Secrets
  • Swarm mode

August 6, 2025​

New Security Labs lessons

Container Security in Docker - Inventory​

  • The Scout
  • Distroless images

OWASP Top 10 2021 labs​

  • OWASP 8: Sleeping with the enemy (Java)
  • OWASP 8: In a Pickle (Node)
  • OWASP 8: Deserialization (Node, .NET)

July 2, 2025​

New Security Labs lessons

Container Security in Docker - Inventory​

  • ImageTragick
  • Content trust

OWASP Top 10 2021 labs​

  • OWASP 7: Authentication bypass (.NET, Java)

June 4, 2025​

New Security Labs lessons

Container Security in Docker - Resources​

  • Soft limits
  • Hard limits

May 7, 2025​

New Security Labs lessons

Container Security in Docker - Resources​

  • Cgroups
  • Cgroups leak
  • The release agent

April 2, 2025​

New Security Labs lessons

Container Security in Docker - Networking​

  • NET namespaces
  • Attack surface
  • Network sockets
  • SSH
  • Inter-container communication
  • iptables

March 5, 2025​

New Veracode branding​

  • Veracode has updated the look-and-feel of Security Labs with new branding.

New Security Labs lessons​

Container Security in Docker - Capabilities

  • Linux capabilities
  • Capabilities in containers
  • Security profiles
  • Game overlay
  • Kernel attack

February 5, 2025​

New Security Labs lessons for Enterprise Edition

Container Security in Docker - Users​

  • Cloning users
  • Cloning groups
  • User namespaces
  • Privilege escalation

Container Security in Docker - Virtualization​

  • UTS namespaces
  • Mount namespaces
  • Attack on Beluga
  • PID namespaces
  • Unmasking Docker
  • Runtime attack

New Security Labs lessons for Community Edition

Container Security​

  • Cloning users

OWASP Vulnerabilities for APIs​

  • One ID to Access All Objects (Java, .NET)

OWASP Vulnerabilities for Web Apps​

  • To Protect and To Serve Secure Cookies (Python, .NET, Rails, Go, Node, PHP)

January 8, 2025​

New Security Labs lessons

OWASP Top 10 2021 labs​

  • OWASP 2: Insufficient Entropy (.NET, Python)

OWASP API Top 10 2023 labs​

  • OWASP API 6: The Great Referral Quest (.NET)
  • OWASP API 10: Gift Cards at Risk (.NET)

December 11, 2024​

New Security Labs features include CWE tagging for lessons and code syntax highlighting.

CWE tagging improves lesson assignment​

  • Admins can search lessons based on CWE or title.
  • Learners can see lessons linked to specific CWEs.

Syntax highlighting improves clarity of code samples​

  • Learners see code syntax highlighting that is tailored to programming languages.

December 4, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs​

  • OWASP 2: Insufficient Entropy (Node)

OWASP API Top 10 2023 labs​

  • OWASP API 6: The Great Referral Quest (Node)
  • OWASP API 7: Retrieval Without Validation (Node)
  • OWASP API 7: Retrieval Without Validation (.NET)
  • OWASP API 10: Gift Cards at Risk (Node)

November 6, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs and OWASP API Top 10 2023 labs​

Four NEW lessons have been released. This includes upgrading the OWASP API Security Top 10 from 2019 to 2023, and adding lessons for three new categories.

  • OWASP 2: Insufficient Entropy (for Java)
  • OWASP API 6: The Great Referral Quest (Java)
  • OWASP API 7: Retrieval Without Validation (Java)
  • OWASP API 10: Gift Cards at Risk (Java)

Lessons will be reorganized to fit into their new position in the OWASP API Security Top 10 (2023) list. An additional More OWASP Vulnerabilities for APIs category was added to include lessons that fall into categories that are no longer in the API Top 10.

September 5, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs​

  • OWASP 1: Redirect Rodeo (Java)
  • OWASP 1: Forging User Requests (Java, Go, Rails)

May 1, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs​

  • OWASP 1: Forging User Requests (Python, Flask)

April 29, 2024​

eLearning course updates​

The following 32 courses now have updated cover pages and optional closed captions:

  • Secure Coding Foundations (7 courses)
  • AppSec Tutorials (11 courses)
  • General Security (9 courses)
  • Mobile Security (4 courses)
  • OWASP Top Ten (2021) (1 course)

April 3, 2024​

New Security Labs lessons

OWASP API Security Top 10 labs​

  • OWASP API 6: Bad Design Compromises Security (JavaScript)
  • OWASP API 7: Jot Down this Key (JavaScript)
  • OWASP API 7: Secret Admin (JavaScript)
  • OWASP API 7: eXternal Entity Injection (JavaScript)
  • OWASP API 7: XML is Always a Challenge (JavaScript)
  • OWASP API 8: Own the Database (JavaScript)
  • OWASP API 8: Parameterize All the Things (JavaScript)
  • OWASP API 8: Bobby Tables (JavaScript)
  • OWASP API 9: Unprotected Deployments (JavaScript)
  • OWASP API 10: The Importance of Logging and Monitoring (JavaScript)
  • OWASP API 10: Logging in the API Infrastructure (JavaScript)

March 6, 2024​

New Security Labs lessons

OWASP API Security Top 10 labs​

  • OWASP API 1: One ID to Access All Objects (JavaScript)
  • OWASP API 1: Stronger IDs (JavaScript)
  • OWASP API 2: Really, Really Bad Passwords (JavaScript)
  • OWASP API 2: Terrible Password (JavaScript)
  • OWASP API 3: Bugs in Debug (JavaScript)
  • OWASP API 3: Revealing Schemas (JavaScript)
  • OWASP API 4: Slow Down (JavaScript)
  • OWASP API 4: Brute Force (JavaScript)
  • OWASP API 4: Denial of Service (JavaScript)
  • OWASP API 5: Neglected Endpoints (JavaScript)

February 7, 2024​

New Security Labs lessons

OWASP Top 10 2021 labs​

  • OWASP 1: Forging User Requests (.NET)

OWASP API Security Top 10 labs​

  • OWASP API 10: The Importance of Logging and Monitoring (Java)
  • OWASP API 10: Logging in the API Infrastructure (Java)

January 16, 2024​

New Security Labs lesson

OWASP API Security Top 10 labs​

  • OWASP API 9: Unprotected Deployments (Java)

Previous updates​

2023 updates​

2023 updates

December 6, 2023​

New Security Labs lessons

OWASP Top 10 2021 labs​
  • OWASP 1: Redirect Rodeo (.NET, JavaScript)
  • OWASP 8: Prototype Protection Agency (JavaScript)
OWASP API Security Top 10 labs​
  • OWASP API 8: Own the Database (Java)
  • OWASP API 8: Parameterize All the Things (Java)
  • OWASP API 8: Bobby Tables (Java)

November 1, 2023​

New Security Labs lessons

OWASP API Security Top 10 labs​
  • API 7: Jot Down This Key (Java)
  • API 7: Secret Admin (Java)
  • API 7: eXternal Entity (Java)
  • API 7: XML is Always a Challenge (Java)

May 3, 2023​

New Security Labs lessons

OWASP Top 10 2021 labs​

New OWASP 10: Get There From Here (Python, Go)

April 5, 2023​

New Security Labs lessons

OWASP Top 10 2021 labs​

New OWASP 10: Get There From Here (.NET, Flask)

OWASP API Security Top 10 labs​
  • API 5: Neglected Endpoints (Java)
  • API 6: Bad Design Compromises Security (Java)
  • API 6: Bad Design Compromises Security (.NET) (revamped!)

March 1, 2023​

New Security Labs lessons

Getting Started Labs​

New Getting Started - Lesson Zero (Flask, Go, Python)

OWASP Top 10 2021 labs​
  • OWASP 1: Broken Access Control - Secrets in the Log (Java)
  • OWASP 4: Making Secure Decisions (Flask, Go, Python)
OWASP API Security Top 10 labs​
  • API 4: Slow Down (Java)
  • API 4: Brute Force (Java)
  • API 4: Denial of Service (Java)

February 1, 2023​

New Security Labs lessons

OWASP Top 10 2021 labs​
  • OWASP 1: Broken Access Control - Loose Lips Sink Servers (.NET)
  • Beyond OWASP Top 10: Other Web App Risks - Know Your Limits (Java)
OWASP API Security Top 10 labs​
  • API 3: Bugs in Debug (Java)
  • API 3: Revealing Schemas (Java)

January 4, 2023​

New Security Labs lessons

OWASP Top 10 2021 labs​

New Beyond OWASP Top 10: Other Web App Risks - Do You Remember? (.NET)

OWASP API Security Top 10 labs​
  • API 2: Really, Really Bad Passwords (Java)
  • API 2: Terrible Password (Java)

2022 updates​

2022 updates

December 6, 2022​

New Security Labs lessons

OWASP Top 10 2021 labs​
  • OWASP 4: Insecure Design - Insecure Decisions (.NET, Java)
  • OWASP 4: Making Secure Decisions (Java)
OWASP API Security Top 10 labs​
  • API 1: One ID to Access All Objects (Java)
  • API 1: Stronger IDs (Java)
Getting Started Labs​

New Getting Started - Lesson Zero (Java, Node)

November 1, 2022​

New Security Labs lessons

OWASP Top 10 2021 labs​
  • OWASP 1: Broken Access Control - Loose Lips Sink Servers (Node)
  • OWASP 4: Insecure Design - Valid Deficit (.NET)
OWASP API Security Top 10 labs​

New API 4: Lack of Resources & Rate Limiting - Denial of Service

October 4, 2022​

New Security Labs lessons

OWASP Top 10 2021 labs​
  • OWASP 4: Insecure Design - Valid Deficit (Node)
  • OWASP 9: Security Logging and Monitoring Failures - Hold the Line (.NET, Java)

September 26, 2022​

Topic Progress Bar Now Focused on Required Labs​

In Security Labs, the progress bar for a topic now shows the completion status for required labs only. If all required labs in a topic are complete, the progress bar shows 100% completion, even when there are incomplete optional labs.

September 6, 2022​

One New Security Labs Lesson

OWASP Top 10 2021 labs​

New OWASP 9: Security Logging and Monitoring Failures - Hold the Line (Node)

August 24, 2022​

New Click-Through Tour​

August 3, 2022​

Three New API Security Labs Lessons

OWASP API Security Top 10 labs​
  • New API 9 Improper Assets Management - Unprotected deployments (.NET)
  • New API 10 Insufficient Logging & Monitoring - The Importance of Logging and Monitoring (.NET)
  • New API 10 Insufficient Logging & Monitoring - Logging in the API Infrastructure (.NET)

July 6, 2022​

Seven New API Security Labs Lessons and One Updated OWASP Course

OWASP API Security Top 10 labs​
  • New API 7 Security Misconfiguration - Jot down this key (.NET)
  • New API 7 Security Misconfiguration - Secret Admins (.NET)
  • New API 7 Security Misconfiguration - eXternal Entity (injection) (.NET)
  • New API 7 Security Misconfiguration - XML is always a Challenge (.NET)
  • New API 8 Injection - Own the database (.NET)
  • New API 8 Injection - Parameterize all the things (.NET)
  • New API 8 Injection - Bobby Tables (.NET)
OWASP Top 10:2021:10 Server-Side Request Forgery​

New Get There From Here (Node)

June 30, 2022​

Updated One eLearning Learner Level Course and Added Two New AppSec Tutorials​
  • Updated the OWASP 2017 course to OWASP 2021 on Learner Level 1
  • Added two new AppSec Tutorials on Learner Level 2

June 1, 2022​

The Security Training Team Released Two New API Security Courses and Updated Eight OWASP Courses

OWASP API Security Top 10 labs​
  • API5:2019 Neglected endpoints (.NET)
  • API6:2019 Bad Design Compromises Security (.NET)
OWASP Top 10 2021 labs​

See the Course Catalog for more details.

  • A01:2021 Broken Access Control
  • A02:2021 Cryptographic Failures
  • A03:2021 Injection
  • A05:2021 Security Misconfiguration
  • A06:2021 Vulnerable and Outdated Components
  • A07:2021 Identification and Authentication Failures
  • A08:2021 Software and Data Integrity Failures
  • A09:2021 Security Logging and Monitoring Failures

May 19, 2022​

The Security Training Team Released Three New eLearning Courses and Updated One Course​
  • Updated A04: eLearning Secure Architecture and Design
  • OWASP Top 10 2021
  • A10: Server-Side Request Forgery AppSec Tutorial
  • A08: Software and Data Integrity Failures AppSec Tutorial

May 4, 2022​

The Security Training Team Released Seven Labs​

OWASP API Security Top 10 Labs:

  • API3:2019 Excessive Data Exposure - Bugs in Debug (.NET)
  • API3:2019 Excessive Data Exposure - Revealing Schemas (.NET)
  • API4:2019 Lack of Resources and Rate Limiting - Slow Down (.NET)
  • API4:2019 Lack of Resources and Rate Limiting - Brute Force (.NET)

OWASP Top 10 2021 Labs:

  • A04:2021 Insecure Design - Making Secure Decisions (.NET)
  • A08:2021 Software and Data Integrity Failures - Sleeping With the Enemy (.NET, Node)
  • A10:2021 Server-Side Request Forgery - Get There From Here (Java)

April 6, 2022​

Two New Labs​
  • OWASP API #1 - Broken Object Level Authorization
  • OWASP API #2 - Broken User Authentication

2021 updates​

2021 updates

April 28, 2021​

New Video - Access and Navigate the Veracode Security Labs Interface​

This video shows you how to:

  • Access and navigate the lab interface
  • Access and interact with the web application, when applicable
  • Communicate with teammates who have completed the lab
  • Save lab progress or restart the lab
New Video - View and Filter Labs in Veracode Security Labs​

This video shows you how to:

  • View new, required, and in progress labs
  • Filter labs by programming language
New Video - Edit and Assign Security Labs Roles to Users​
  • This video shows you how to edit roles, assign roles to users, and create managers for those roles in Veracode Security Labs.
New Video - Create a Campaign and Assign Content to Roles in Security Labs​
  • This video shows you how to create a new campaign and assign content to roles in Veracode Security Labs.
New Video - Customize Lab Content in Veracode Security Labs​

Watch this video to learn how to:

  • Customize lab content by modifying or writing your own conclusion
  • Write your own labs using Security Labs as a sandbox
  • Create an example application using your own code
New Video - Add and View Due Dates for Assignments in Veracode Security Labs​

Watch this video to learn how to:

  • Add and view a due date for an assignment
  • Enable competition mode as an administrator
New Video - View and Report on User Progress in the Veracode Security Labs Reporting Page​
  • This video shows you how to report on user progress in Veracode Security Labs and the API.

April 27, 2021​

Automated User Progress Notifications​

You can configure automated email notifications to accomplish these tasks for Veracode Security Labs:

  • Inform managers of their team progress in a campaign or assignment
  • Remind users when they have required labs that are incomplete

You can define the schedule and customize the message for each notification type.

April 2, 2021​

New Video - Create Users Within Veracode Security Labs or by Using Your Company SSO​
  • This video shows you how to create users from within the Security Labs interface.

March 4, 2021​

Enable Team-Based Competition in Security Labs​
  • You can create Veracode Security Labs campaigns that allows users to collaborate and compete between groups. If you enable competition mode and assign different roles to users, the leader board for the campaign adds the scores by role and displays the collective team totals.
Continuous Learning Paths in Security Labs​
  • You can assign Security Labs users to continuous campaigns that automatically provide the next assignment after the user completes the required labs of the previous assignment.
Allow Step Omissions in Security Labs​

  • You can configure Security Labs to allow users to skip steps in a lab that they cannot complete. Users do not receive points for skipped steps.

  • This feature only applies to Java OWASP labs.

2020 updates​

2020 updates

November 23, 2020​

Auto-Extend for eLearning Enabled by Default​
  • The default setting for new Veracode eLearning course track assignments is to automatically extend when their subscription periods end.
Improved eLearning Performance​
  • Veracode has increased the loading speed of the My Team's Courses page in Veracode eLearning.

October 29, 2020​

Improvements to eLearning​

Veracode has made these improvements to eLearning:

  • eLearning administrators can now assign a learner to multiple eLearning curricula.
  • Veracode added seven new Secure Coding Foundation courses to learner level 1. Learners who previously completed level 1 must take the newly-added courses to complete this level. Because each level depends on the previous level, these levels show as incomplete until the learner completes them.
  • The eLearning report for learners now includes a Date Started column.
  • The eLearning settings have been removed from the Admin > Manage Users page. All eLearning administration actions are now available from the Admin > eLearning page. This page provides a centralized location where you can use filtering options and perform all actions on one or more learners.
  • The eLearning fields have been removed from the SAML Self-Registration page.

August 29, 2020​

Improvements to Security Labs​

Veracode has made these improvements to Security Labs:

  • Integration with the Veracode Platform. By default, if you have the Security Labs User role, Veracode automatically creates your Security Labs account in the Platform. If you have the Administrator role, you automatically have administrator permissions within Security Labs.
  • New Assignment Creation wizard. When creating a new set of lab assignments on the Assign Content page, you can now get suggested lab assignments based on a focus. For example, Beginner/Intermediate/Advanced, PCI Training, Backend/Frontend, or Competition.
  • New Scala labs for the OWASP Top 10. These labs use the Play framework.

June 27, 2020​

Enhancements to eLearning Curriculum Creation​
  • Veracode has improved the user interface for creating an eLearning curriculum to make it easier for administrators to identify courses to add to a curriculum. The new user interface now includes the length and description of each course. When selecting courses, the administrator can also use a checkbox to make courses required.

June 2, 2020​

Bulk Actions for eLearning Administrators​
  • Veracode eLearning administrators can now apply actions, including assigning learners to tracks or curricula and enabling automatic track extensions, to multiple users at once. This enhancement simplifies the process of onboarding and managing eLearning users.
]]> <![CDATA[VRM updates]]> https://docs.veracode.com/updates/r/VRM_updates 2026-05-26T00:00:00.000Z The updates on this page apply to Veracode Risk Manager (VRM). Subscribe to the VRM updates RSS feed Feed-icon.png.

May 26, 2026​

Automated workflows​

Patterns are now available from the VRM settings page, allowing you to automatically:

  • Assign assets to applications.
  • Assign labels to assets.
  • Create tickets from issues.
  • Update the status of issues.

March 26, 2026​

Table enhancements​

With improvements to tables in VRM, you can now:

  • Export the Applications table with custom filters applied as a CSV file.
  • View IP addresses in the Assets table in a dedicated column.
  • Search by Target Name in the Solutions table.

Adds details to MPT issues​

Veracode Manual Penetration Testing (MPT) issue details now include Severity, Exploit, Remediation, and Location fields.

January 23, 2026​

Veracode MPT results are now available in VRM​

Users who have Veracode Manual Penetration Testing (MPT) results can now see individual MPT records as issues in VRM.

November 27, 2025​

Adds support for Qualys tag metadata​

Qualys tag metadata is now displayed in the detail page for an issue.

November 12, 2025​

Adds asset label filtering for issues​

You can now filter issues in VRM by the asset labels of assets associated with those issues.

November 9, 2025​

Integrates VRM with Veracode Platform identity management​

VRM is now integrated with the Veracode Platform for authentication, user management, and team management.

October 29, 2025​

Adds support for GCP onboarding​

VRM now supports GCP onboarding with a new user interface that includes a workflow for mapping GCP tagging to VRM factors.

October 24, 2025​

GCP asset updates for October​

VRM adds support for assets from the following sources:

  • GCP Firestore
  • GCP Secret Manager
  • GCP Certificate Manager
  • GCP KMS key
  • GCP users
  • GCP compute group
  • GCP Networking

September 23, 2025​

GCP asset and findings updates for September​

VRM adds support for assets and findings from the following sources:

Assets:

  • GCP Cloud SQL database
  • GCP roles
  • GCP projects

Findings:

  • GCP Security Command Center

September 20, 2025​

Simplified issue URLs​

Issue URLs in VRM are simplified by removing connector ID information. The unique issue identifier is now sufficient for routing.

Example of the change:

  • Before: https://app.longbow.security/issues/67a63f200aaa7e13da3a70a8/ae0186ed-d12b-377d-a430-8a036b75e8ce
  • After: https://app.longbow.security/issues/ae0186ed-d12b-377d-a430-8a036b75e8ce

July 19, 2025​

Adds Azure workstations to VRM​

VRM now ingests Azure workstation type assets from the Azure cloud platform. For many users, this includes laptop assets if they are managed by Azure.

July 17, 2025​

Adds issue filtering by reason​

You can now filter issues in VRM by the reason provided for the status change, such as Remediating Risk or False Positive.

July 3, 2025​

Displays Qualys hostname for assets​

VRM now shows the hostname instead of the numeric Qualys ID for assets ingested from Qualys.

May 6, 2025​

Universal Connector API for ingesting asset and finding data​

The Universal Connector now supports ingesting asset and finding data in CSV or JSON format through an API endpoint.

May 2, 2025​

Filter issues by Veracode BU and teams​

VRM now ingests business unit and team metadata from Veracode application profiles and allows filtering issues by business unit and team.

April 10, 2025​

Azure Hybrid Compute assets​

VRM now ingests Azure Hybrid Compute assets and associates them with issues identified by Defender or other finding sources.

March 27, 2025​

New VRM features​

New connectors​

These new connectors allow Veracode Risk Manager (VRM) to quickly and easily ingest security findings and asset inventory from a variety of popular security tools.

Azure DevOps Ticketing

This ticketing connector enhances the issue management workflow in VRM by allowing users to create tickets in Azure DevOps (ADO) for any issue in VRM. This connector is bidirectional: as tickets are resolved in ADO that status change will be reflected in VRM.

CrowdStrike CWP

CrowdStrike Cloud Workload Protection (CWP) provides runtime protection, threat detection, and visibility for workloads across cloud environments. It helps secure containers, virtual machines, and Kubernetes deployments by identifying and stopping threats in real time.

GitHub Advanced Security

GitHub Advanced Security (GHAS) delivers integrated security capabilities to secure the software development lifecycle directly within GitHub. It includes code scanning for identifying vulnerabilities in code, secret scanning to detect and prevent credential exposure, and dependency review to analyze risks in third-party packages.

JFrog Artifactory

JFrog Artifactory is a universal artifact repository that securely stores, manages, and distributes software packages, binaries, and containers.

Qualys

Qualys is a widely recognized leader in cloud-based vulnerability management, offering comprehensive security solutions to help organizations identify, assess, and remediate potential threats. VRM’s connector ingests vulnerability findings from Qualys for inclusion in VRM’s issue analysis and reporting.

Second-party package analysis​

VRM now analyzes Veracode SAST findings to identify Second Party Packages, which are libraries built internally and used across application teams. VRM creates solutions that identify the specific package so development teams can select the highest-impact remediation actions.

Column management​

In the issue and asset tables, you can customize the displayed columns. This allows you to select from VRM’s extensive contextual data, including numerous Urgency Factors and Severity Factors. These tools enable you to create views that instantly identify outliers and dangerous factor combinations and assess compliance without needing to drill down into the details.

Ticketing metrics​

Application security teams can now track MTTR and MTTA for their Jira, ServiceNow, and ADO tickets created within VRM. Ticket disposition is easily tracked in any VRM table or dashboard.

Dashboard charts​

Custom dashboards have two new card types: donut charts and bar charts. These new dashboard card types can be used to graphically represent issues and can be filtered by any dimension available in VRM, including account, tag, application, asset type, compliance framework, and ticket status.

October 31, 2024​

New VRM features​

Custom risk remediation dashboards​

With VRM custom dashboards, administrators can easily customize how you visualize your application security, risk reduction, or issue prioritization. You can create dashboards that meet the specific needs of your organization.

Okta SSO Integration​

You can now easily manage users via SSO using VRM's Okta integration. Enabling SSO for users allows you to manage authentication compliance through a central system rather than ensuring VRM's sign-on is also compliant, reducing the organizational overhead needed to manage another system's authentication.

ServiceNow Connector​

The ServiceNow Connector for VRM connects VRM's best next actions and issues to ServiceNow's IT Service Management (ITSM) plugin. The connector leverages the ServiceNow API to create incident or request tickets to ensure VRM's powerful recommendations get to the next stage of remediation and are delivered to the correct teams' workflows.

Veracode Connector 1.5​

VRM ingests and analyzes all your Veracode AST findings to create a complete and unified view across Veracode Static Analysis, Dynamic Analysis, and SCA issues. VRM leverages the Veracode Platform's policy enforcement and vulnerable methods data for issue urgency analysis.

In this release, you can also map Veracode issues back to the source code repository where the issues originated. These changes provide rich remediation instructions for weaknesses and vulnerabilities detected by Veracode AST products.

Vulnerability Management Connectors: Rapid7 and Tenable​

The new Rapid7 and Tenable connectors for VRM allow you to bring in critical operational vulnerability data from the assets you are scanning. Coordinating this data with other risk elements allows your teams to save significant expert time and create tasks that make the most of your resource investments.

August 16, 2024​

New VRM features​

Application security heatmap​

With VRM Applications, you can organize assets into groups that align with your organization’s internal applications. These applications can reflect the work of internal development teams or simply be logical collections of runtime assets that deliver a business function for the enterprise. The application security heatmap provides you with an at-a-glance view of risk for all applications and allows you to drill down and see the assets, issues, solutions, and score trending for a specific application.

Universal Connector 1.0​

The VRM Universal Connector enables you to connect to any data source to ingest assets and findings. It unlocks the potential for VRM to provide its issue prioritization and enrichment to any data source, whether it be a vulnerability scanner, asset discovery tool, CNAPP solution, or cloud security utility, through a straightforward API setup.

GitLab Repository Connector​

VRM has added support for the GitLab Repository Connector. This allows VRM to connect to your GitLab repositories, scan the files and logs, and then analyze that data to identify IaC configuration files and inventory image hashes. VRM uses this data to map runtime ACR and ECR images to their origin in the version control system.

GitLab Ultimate security findings: Container & SAST​

VRM has added support for the GitLab Ultimate Connector. This connector allows VRM to create issues from Container and SAST findings discovered by GitLab Ultimate. This capability requires no additional setup. If you have already configured the GitLab Repository Connector and you have a license to GitLab Ultimate, VRM will gather these findings automatically.

Veracode connector: New asset type for application profiles​

With the Veracode Connector, you can now create assets based on Veracode application profiles. VRM can display all SAST, DAST, and SCA issues in association with their parent application profile in the Asset and Issue tables in the VRM console. VRM admins can also group these application profile assets within any VRM application (VRM’s native asset grouping).

UI enhancement: Saved filters​

You can now save filters with all the filter menus in the VRM console. You can easily save any combination of filters set for tables or dashboards without needing to leave the filter menus. This allows customers to easily save critical use cases and easily access them across the product.

Early release: Custom compliance mappings​

The VRM platform now allows you to filter the Issues table by custom compliance standards that you define. This feature is in early release. To enable it, please reach out to your Customer Success Manager.

In addition to any custom compliance mappings your organization implements, VRM supports the following compliance frameworks out-of-the-box: CIS AWS 1.4, CIS AWS 1.5, CIS AWS 2.0, NIST 800-53 Rev 5

Additional updates​

  • Updated the API to allow editing of multiple applications in one API request
  • Added support for filters when editing applications with the API
  • Added hash-based vulnerability findings detection to enable collection of additional vulnerabilities from Azure
  • Added “group by” support for specific fields when listing solutions with the API.

Bug fixes​

  • Fixed issue where some CVE issues would not be created for application profile assets.
  • Fixed issue where some Prisma Cloud finding types would not generate solutions.
  • Fixed issue with the application histogram where issues with scores at division boundaries were not grouped properly.
]]>