Veracode helps you write secure code — and find the security issues in the code you've already written. This guide is written for developers: what to set up, how to scan, and how to make sense of results without it taking over your day.
Your Workflow in Three Steps
- Scan your code — from your IDE or as part of your pipeline.
- Review findings — understand what was found and why it matters.
- Fix or mitigate — remediate the issue or document why it's acceptable.
Step 1: Get Your API Credentials
You need Veracode API credentials (an API ID and API key) to use IDE plugins and pipeline integrations. Generate these in the Veracode Platform under your account settings.
- Docs: Generate API Credentials
Step 2: Install Your IDE Plugin
All four modern Veracode IDE plugins support SAST, SCA, and Veracode Fix.
| IDE | Features | Docs |
|---|---|---|
| JetBrains | SAST + SCA + Veracode Fix | docs.veracode.com/r/Scan_for_JetBrains |
| VS Code | SAST + SCA + Veracode Fix | docs.veracode.com/r/Veracode_Scan_for_VS_Code |
| Visual Studio | SAST + SCA + Veracode Fix | docs.veracode.com/r/Veracode_Scan_for_Visual_Studio |
| Eclipse | SAST + SCA + Veracode Fix | docs.veracode.com/r/c_ide_eclipse |
Note: All four modern Veracode Scan plugins (VS Code, JetBrains, Visual Studio, and Eclipse) can only be installed on one machine per user account. Installing a plugin on multiple machines may cause authentication failures with Veracode. See the plugin-specific Docs pages for details.
Roles Required: To run SAST scans from an IDE, your account needs the Security Lead, Creator, or Submitter role. For SCA agent-based scans (via IDE or CLI): Security Lead, Workspace Administrator, Workspace Editor, or Submitter. Note: SCA via Upload and Scan requires the Executive, Security Lead, or Administrator role.
Step 3: Run Your First Scan
Once the plugin is installed and your credentials are configured, scan your project. The plugin will package your code, upload it to Veracode for analysis, and return findings directly in your editor.
Tip: Start with a small, well-understood project or module for your first scan. This helps you calibrate what to expect before scanning larger codebases.
Important: Results from the IDE plugins are only available in your IDE — they do not appear in the Veracode Platform. To get policy-tracked results visible to your security team, use Upload and Scan.
Veracode Fix: AI-Assisted Remediation
Veracode Fix is available in all four modern IDE plugins (VS Code, JetBrains, Visual Studio, and Eclipse) and can be integrated into GitHub Actions workflows via the Veracode CLI. It generates suggested code patches for findings discovered by Pipeline Scan. Always review suggested fixes before applying. Note: Veracode Fix resolves Pipeline Scan findings only — it does not apply to Upload and Scan findings. A Veracode Fix license is required.
- Docs: About Veracode Fix
Pipeline Scanning
For automated security testing, add Veracode Pipeline Scan to your CI/CD pipeline. It runs a fast Static Analysis scan on every build and can be configured to fail the build if new findings above a certain severity are introduced.
- Docs: Pipeline Scan
- Community: Integration Pathways Hub
Pipeline Scan Limits to Know: Maximum scan time: 60 minutes · Maximum file size: 200 MB · Rate limit: 6 scans per 60 seconds per account
Useful Resources
- All IDE Plugins and Extensions
- IDE Plugins & Your First Scan — Community Guide
- Packaging Requirements
- SCA Agent-Based Scan
- About Veracode Fix
Learning Paths
Go deeper with these step-by-step learning paths on Veracode Docs:
← Back to the Getting Started Guide | ← Back to the Onboarding Hub
.png){kind=logo}
