If you're responsible for CI/CD pipelines and build automation, this guide is for you. Your role is to make security scanning automatic, consistent, and as frictionless as possible for the development teams you support.
Scan Types and Where They Fit in Your Pipeline
| Scan Type | Best Pipeline Stage | Docs |
|---|---|---|
| Pipeline Scan (SAST) | Pre-merge / pull request checks — fast, breaks builds on new findings | docs.veracode.com/r/Pipeline_Scan |
| Upload and Scan (SAST) | Nightly or per-release — comprehensive, policy-tracked | docs.veracode.com/r/Veracode_Upload_and_Scan |
| SCA Agent Scan | Any stage — fast, no compilation needed | docs.veracode.com/r/SCA_agent_based_scanning |
| DAST Essentials | Staging environment — requires deployed application | docs.veracode.com/r/Dynamic_Analysis |
Setting Up Pipeline Scan
- Get API credentials — Create an API Service Account with either the Upload and Scan API role or the Upload API - Submit Only role. Docs: docs.veracode.com/r/c_api_credentials3
- Package your application — Pipeline Scan requires a compiled/packaged artifact. Docs: docs.veracode.com/r/compilation_packaging
- Download the Pipeline Scan tool — Available as a JAR or Docker image. Always use pipeline-scan-LATEST.zip to stay current.
- Add the scan step to your pipeline — Runs after your build stage. Configure
--fail_on_severityand--baseline_file. - Store credentials securely — Use your pipeline's secrets management (GitHub Secrets, GitLab CI Variables, Jenkins Credentials, etc.).
Pipeline Scan Limits: Max scan time: 60 minutes · Max file size: 200 MB · Rate limit: 6 scans per 60 seconds per account
Important: Pipeline Scan is not connected to the Veracode Platform and does not support flaw mitigations or flaw matching. For those features, use Upload and Scan (Policy or Sandbox scan).
- Docs: CI/CD Integrations
SCM Integrations
- GitHub — Workflow Integration (SAST, SCA, Container Security) and GitHub Actions. docs.veracode.com/r/SCM_integrations
- GitLab — GitLab Workflow Integration. docs.veracode.com/r/SCM_integrations
- Azure DevOps — Azure DevOps Extension and Workflow Integration. docs.veracode.com/r/c_VS_team_servs
Using a Baseline File for Legacy Findings
If your codebase already has findings, use a baseline file so Pipeline Scan only fails the build on new findings — not pre-existing ones. This lets teams manage legacy findings separately from new code.
- Docs: Creating a Baseline File
Network Requirements
All Veracode API calls require outbound HTTPS on port 443. If your CI/CD environment is behind a firewall or proxy, your IT team may need to allowlist Veracode's IP addresses.
Useful Resources
Learning Paths
Go deeper with these step-by-step learning paths on Veracode Docs:
← Back to the Getting Started Guide | ← Back to the Onboarding Hub
.png){kind=logo}
