Veracode

---
name: veracode
description: "Expert agent for Veracode application security platform. Covers binary/bytecode analysis, Policy Scan, Pipeline Scan, Veracode Fix AI remediation, SCA, DAST, eLearning, and compliance reporting. WHEN: \"Veracode\", \"Veracode policy scan\", \"Veracode pipeline scan\", \"Veracode upload\", \"Veracode Fix\", \"Veracode eLearning\", \"binary analysis\", \"bytecode scanning\"."
license: MIT
---

# Veracode

This skill covers the Veracode application security platform. Veracode is distinguished by its binary and bytecode analysis approach — it analyzes compiled artifacts rather than source code, eliminating build environment dependencies and providing deeper analysis of compiled code behavior.

## How to Approach Tasks

1. **Identify the scan type:**
   - **Policy Scan** (formerly Static Analysis) — Full depth, used for compliance gates and release approval
   - **Pipeline Scan** — Fast, lightweight, used in CI/CD PRs
   - **SCA (Software Composition Analysis)** — Open source vulnerability and license scanning
   - **DAST** — Dynamic Application Security Testing
2. **Identify the application type:** Web app, mobile, microservice, desktop — affects packaging requirements.
3. **Identify compliance context:** Veracode is widely used for compliance (PCI DSS, FedRAMP, HIPAA, SOC 2) — policy definitions matter.

## Binary/Bytecode Analysis Approach

Veracode's core differentiator is analyzing compiled artifacts:

**Why binary analysis:**
- **No source code required:** Analyze third-party code, legacy code without source
- **Build-environment independence:** No need to replicate exact build configuration
- **Deeper analysis:** Compiled bytecode exposes data flows that source-level analysis misses
- **Post-build accuracy:** Analysis reflects actual compiled behavior, including compiler optimizations

**Supported artifact types:**

| Language | Artifact Type | Notes |
|---|---|---|
| Java | `.jar`, `.war`, `.ear` | Include all dependencies in archive |
| .NET (C#, VB.NET) | `.dll`, `.exe` | Debug symbols (.pdb) improve results |
| JavaScript/TypeScript | Source files (`.js`, `.ts`) | Bundled or unbundled |
| Python | Source files (`.py`) | With `requirements.txt` |
| PHP | Source files (`.php`) | |
| Ruby | Source files (`.rb`) | |
| Go | Compiled binary | |
| Android | `.apk` | |
| iOS | `.ipa` | |
| C/C++ | Source or compiled | |

---

## Policy Scan

Policy Scan is the full-depth analysis. It is asynchronous — you upload artifacts and Veracode's cloud infrastructure analyzes them (typically 30 minutes to a few hours depending on artifact size).

### Packaging Requirements

Proper packaging is critical. Incorrectly packaged applications are the most common source of scan failures and poor results.

**Java packaging best practices:**
```bash
# WAR file — web application
# Must include:
# - Compiled classes in WEB-INF/classes/
# - All dependency JARs in WEB-INF/lib/
# - Do NOT include test JARs or build tool JARs

# Maven: create deployable WAR
mvn package -DskipTests

# Fat JAR (Spring Boot, etc.)
# Veracode requires extracting and re-packaging Spring Boot fat JARs
# Use the Veracode packaging guide for Spring Boot specifics
```

**C# / .NET packaging:**
```bash
# Publish self-contained (includes all dependencies)
dotnet publish -c Release -r win-x64 --self-contained

# ZIP the publish directory for upload
zip -r app-publish.zip ./publish/

# Include PDB files for better results (more precise line numbers)
```

### Policy Configuration

A Veracode policy defines the acceptance criteria for an application:

- **Scan frequency requirements** (e.g., Policy Scan within last 90 days)
- **Flaw criticality gates** (e.g., no open Very High or High findings)
- **Remediation SLAs** (e.g., Very High: fix within 30 days)
- **Custom mitigations allowed** (approved risk acceptance workflows)

Policies are assigned at the application profile level. Multiple applications can share a policy.

**Common policy verdicts:**
- `Pass` — All conditions met
- `Did Not Pass` — One or more conditions violated
- `Conditional Pass` — Within grace period after finding new issues

### Upload and Scan (Veracode XML API)

```bash
# Using Veracode API wrapper (Python)
pip install veracode-api-signing

# Upload artifact
java -jar VeracodeJavaAPI.jar \
  -vid $VERACODE_API_ID \
  -vkey $VERACODE_API_KEY \
  -action uploadfile \
  -appname "My Application" \
  -createprofile true \
  -filepath ./target/myapp.war

# Begin scan
java -jar VeracodeJavaAPI.jar \
  -vid $VERACODE_API_ID \
  -vkey $VERACODE_API_KEY \
  -action beginprescan \
  -appname "My Application" \
  -autoscan true
```

---

## Pipeline Scan

Pipeline Scan is designed for CI/CD integration. Key differences from Policy Scan:

| Aspect | Policy Scan | Pipeline Scan |
|---|---|---|
| Speed | 30min - 2hrs | 1-10 min |
| Depth | Full | Limited (no taint beyond function boundary) |
| Artifact size limit | Up to 5GB | 200MB |
| Purpose | Compliance gate, release approval | Developer feedback, PR gate |
| Result format | Veracode platform UI + XML | JSON |
| Baseline comparison | Yes | Yes (via baseline file) |

### Pipeline Scan Usage

```bash
# Download Pipeline Scanner
curl -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip
unzip pipeline-scan-LATEST.zip

# Run scan
java -jar pipeline-scan.jar \
  --veracode_api_id $VERACODE_API_ID \
  --veracode_api_key $VERACODE_API_KEY \
  --file ./target/myapp.jar \
  --fail_on_severity "Very High, High" \
  --json_output_file results.json

# Fail on new findings only (requires baseline)
java -jar pipeline-scan.jar \
  --veracode_api_id $VERACODE_API_ID \
  --veracode_api_key $VERACODE_API_KEY \
  --file ./target/myapp.jar \
  --baseline_file baseline.json \
  --fail_on_severity "Very High, High"
```

### Baseline File Pattern

The baseline file records existing findings so the pipeline only fails on NEW issues:

```bash
# Generate baseline from current findings (run once on main branch)
java -jar pipeline-scan.jar \
  --file ./target/myapp.jar \
  --json_output_file baseline.json

# Commit baseline.json to repository

# In feature branch CI: compare against baseline
java -jar pipeline-scan.jar \
  --file ./target/myapp.jar \
  --baseline_file baseline.json  # Only new findings cause failure
```

### GitHub Actions

```yaml
- name: Veracode Pipeline Scan
  uses: veracode/Veracode-pipeline-scan-action@v1
  with:
    vid: ${{ secrets.VERACODE_API_ID }}
    vkey: ${{ secrets.VERACODE_API_KEY }}
    file: ./target/myapp.jar
    fail_build: true
    severity: "Very High, High"
    baseline_file: baseline.json
```

---

## Veracode Fix (AI Remediation)

Veracode Fix uses AI to generate code patches for discovered vulnerabilities.

**How it works:**
1. Static analysis finds a vulnerability with data flow
2. Veracode Fix analyzes the data flow path and vulnerable code pattern
3. AI generates a code patch (in the same language/framework)
4. Developer reviews and applies the fix

**Supported languages:** Java, JavaScript, Python, TypeScript, C#, PHP, Go, Kotlin, Scala.

**Fix quality:** Context-aware fixes that use your existing code patterns. Better quality than generic examples because the AI sees the actual data flow, not just the vulnerable line.

**Usage:**
```bash
# Veracode CLI with fix generation
veracode fix --help

# Generate fixes for high severity findings
veracode fix \
  --file results.json \
  --severity "Very High,High" \
  --output-dir ./fixes
```

Fixes are also available in the Veracode platform UI — click a finding, view the "Fix" tab for the AI-generated patch.

---

## Veracode SCA

Veracode SCA (acquired from SourceClear) provides open source vulnerability scanning.

**Scan modes:**
- **Agent-based:** Install Veracode SCA agent, runs during build
- **Upload-based:** Embedded in Policy Scan (analyzes dependencies in uploaded artifacts)
- **Repository scanning:** Connect to GitHub/GitLab for automatic scanning

```bash
# Agent-based scan
curl -sSL https://download.sourceclear.com/ci.sh | bash

# Maven integration
mvn com.srcclr:srcclr-maven-plugin:scan

# NPM
srcclr scan --url https://github.com/my-org/my-repo
```

**SCA features:**
- CVE detection with CVSS scores
- License compliance (identify copyleft licenses)
- Vulnerability remediation: shows which version fixes the issue
- Transitive dependency analysis
- SBOM export (CycloneDX, SPDX formats)

---

## Veracode DAST

Veracode DAST performs dynamic testing against running applications.

**DAST Essentials:** Simplified automated scanning for basic coverage.
**DAST Enterprise:** Full-featured with API scanning, authenticated scan, CI/CD integration.

```yaml
# Veracode DAST configuration
target_url: https://test.example.com
auth_configuration:
  type: form_based
  username: testuser
  password: testpass
  login_url: https://test.example.com/login
scan_configuration:
  scan_type: quick
  fail_on_severity: high
```

---

## eLearning Platform

Veracode eLearning provides security training tied to findings:

- **Contextual training:** When a developer receives a finding, Veracode links directly to a relevant training module
- **Curriculum management:** Assign training paths based on role (developer, AppSec, architect)
- **Completion tracking:** Dashboard showing team training completion rates
- **Languages:** Courses available for Java, .NET, JavaScript, Python, PHP, mobile

This closes the feedback loop: developer finds vulnerability → takes targeted training → understands fix → less likely to reintroduce the issue.

---

## Compliance and Reporting

Veracode is used extensively for regulatory compliance:

**Supported standards:** PCI DSS, OWASP, SANS/CWE Top 25, HIPAA, NIST, FedRAMP, FISMA, DISA STIG.

**Reports available:**
- **Policy Compliance Report:** Pass/fail per policy condition
- **Detailed Findings Report:** All findings with severity, CWE, remediation guidance
- **SBOM Report:** Software inventory for SCA
- **Remediation Scorecard:** Tracks fix progress over time

**Veracode Verified:** A program where applications meeting Veracode's security standard receive a Verified seal for customer trust (useful for B2B SaaS vendors).

---

## Common Issues

**"No supported files" error:**
- Wrong artifact packaging — check Veracode packaging guide for specific language
- For Java: classes must be compiled; source-only JARs not supported
- For Spring Boot: use the Spring Boot repackaging instructions

**Low module detection:**
- Ensure dependencies are included in the artifact (fat JAR, WEB-INF/lib populated)
- For .NET: include all referenced DLLs in the upload ZIP

**Pipeline scan timing out:**
- Artifact over 200MB: use upload compression or split into components
- Network timeout: use `--timeout` parameter, increase default 60-minute timeout

**Policy "Did Not Pass" with no new findings:**
- Check scan frequency requirement in policy (must scan within N days)
- Check SLA violations: existing findings past their remediation due date
- Review "Conditional Pass" grace period expiry