Veracode

Greenlight gives instant in-IDE feedback as code is written, retiring 2026-12-31; Scan plugins run on demand.

Not offered in vendor documentation reviewed as of 2026-09-05.

Veracode CLI and Pipeline Scan JAR/Docker run locally; --allow-dirty re-verifies uncommitted changes

Pipeline Scan posts results to PRs; Fix GitHub Action adds PR comments and annotations

Veracode checks configurable as required status checks; --fail_on_severity/--fail_on_cwe break builds

Upload and Scan of packaged artifacts; repository scanning on push across all org repos

Policies enforce scan cadences - quarterly, semi-annual or annual - so repeat scans run on schedule.

DAST scans live apps/APIs; Quick scan safe in production; EASM discovers external assets

Upload and Scan plus Pipeline Scan on compiled/packaged artifacts, CWE-mapped, 0-5 severity scoring

Not offered in vendor documentation reviewed as of 2026-09-05.

Container/IaC scanning detects secrets via configurable RE2 secret-rules; 60+ named provider key types

Not offered in vendor documentation reviewed as of 2026-09-05.

Agent-based scan with quick, full and vulnerable-methods depths; direct vs transitive dependency graph

Vulnerable Methods scan (Level 3) checks whether first-party code calls vulnerable third-party methods

Veracode Package Firewall blocks malicious open-source packages at the registry level

License-risk ratings per component; policy rules block high-risk, non-OSS or unrecognized licenses

REST API and 'veracode sbom' CLI output CycloneDX 1.6, SPDX 2.3, Syft JSON; unbuilt Gradle limited

IaC misconfiguration scanning via repository integrations and CLI scan command with Rego custom policy

Container image/archive scanning across nine base OS families for vulns, misconfigurations, secrets

Veracode Risk Manager aggregates cloud infrastructure and security-tool findings; no native CSPM scanner documented

DAST covers web apps and REST/SOAP/OpenAPI/Postman APIs; Enterprise mode adds API spec management

SAST reports a 'Code Quality' CWE finding category covering non-security maintainability defects.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Security Quality Score, Veracode Levels VL1-VL5, open-flaw age and time-to-resolve dashboards; security debt only

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Buyers author custom regex secret rules plus Rego container and IaC policies.

Veracode Fix suggests up to five RAG-matched patches per flaw in CLI and IDE; Pipeline Scan findings only

Fix GitHub Action creates branch and PR; SCA auto-opens dependency-upgrade PRs on GitHub/GitLab

Vulnerable-methods reachability and VRM dedup/correlation cut noise; mitigation workflow is manual, not AI triage

Multi-module build uploads let you choose which modules to scan, adjacent to monorepo scanning; repo-scanning docs never use the term "monorepo" or describe per-directory project scoping.

Veracode Fix uses ML plus RAG for remediation only; no AI reviewer that finds issues itself

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

Not offered in vendor documentation reviewed as of 2026-09-05.

A Veracode Fix whitepaper states customer code is never used to further train that model, but the commitment is scoped to Fix only; a platform-wide statement is gated behind Veracode's Trust Center.

User activity log and audit trails documented for enterprise governance

SSO/SAML documented, including a SAML gateway for standalone Security Labs accounts

Named roles including Security Lead, Reviewer, Security Labs admin/manager/user, Free Trial Admin

Pre-built analytics dashboards, PDF/JUnit/CSV DAST reports, SARIF export, REST API report retrieval