IDE Plugins & Your First Scan

Everything you need to scan from your IDE and understand your first results


Scanning from your IDE is the fastest way to get security feedback. This hub covers setup, running your first scan, and making sense of what you find — for all four modern Veracode IDE plugins.

Which Plugin Should I Use?

All four modern Veracode IDE plugins support SAST, SCA, and Veracode Fix. Choose the one that matches your development environment.

IDE Features Docs
JetBrains SAST + SCA + Veracode Fix docs.veracode.com/r/Scan_for_JetBrains
VS Code SAST + SCA + Veracode Fix docs.veracode.com/r/Veracode_Scan_for_VS_Code
Visual Studio SAST + SCA + Veracode Fix docs.veracode.com/r/Veracode_Scan_for_Visual_Studio
Eclipse SAST + SCA + Veracode Fix docs.veracode.com/r/c_ide_eclipse

Note: All four modern Veracode Scan plugins (VS Code, JetBrains, Visual Studio, and Eclipse) can only be installed on one machine per user account. Installing a plugin on multiple machines may cause authentication failures with Veracode. See the plugin-specific Docs pages for details.

All IDE Plugins: docs.veracode.com/r/IDEs

Before You Start: Prerequisites

  • A Veracode user account with the Security Lead, Creator, or Submitter role (for SAST) or Workspace Administrator, Workspace Editor, or Submitter role (for SCA agent-based scans via IDE or CLI). Note: SCA via Upload and Scan requires the Executive, Security Lead, or Administrator role.
  • API credentials generated and stored in a credentials file on your local machine
  • A supported version of your IDE and a project of a supported language
  • Docs: Generate API Credentials
  • Docs: Packaging Requirements

Note on JetBrains: The JetBrains plugin can only be installed on one machine. If you install it on multiple machines, authentication with Veracode may fail. Docs: docs.veracode.com/r/Scan_for_JetBrains

SSO users: If your organization uses Single Sign-On (SSO), API credential file setup may be optional. The modern IDE plugins support OAuth-based SSO authentication.

Running Your First Scan

  1. Open your project in your IDE.
  2. Open the Veracode Scan panel (the panel name varies by IDE).
  3. Select Scan Project (or equivalent).
  4. Wait for the scan to complete — the plugin packages, uploads, and returns results automatically.

Tip: Start with a small, well-understood project or module. This helps you calibrate what to expect before tackling your main codebase.

Scan limits: A Veracode account is limited to 6 Static Analysis scans per 60 seconds, and each scan has a maximum run time of 60 minutes. File size limit: 200 MB.

Understanding Your Results

Results appear inline in your editor. Findings are grouped into:

  • SAST findings (Flaws) — Vulnerabilities in your own code, listed with severity and CWE reference
  • SCA findings (Vulnerabilities) — Known vulnerabilities in open-source libraries your project depends on
  • SCA Licenses — License risk information for open-source dependencies

Important: IDE Scan Results Stay in Your IDE

Results from the modern IDE plugins are only available in your IDE — they do not appear in the Veracode Platform. To get results that appear in the Platform (for policy tracking, Analytics, and team-level review), use Upload and Scan or link your Pipeline Scan to an application profile.

Using Veracode Fix

Veracode Fix is available in all four modern IDE plugins. It generates AI-suggested code patches for findings from Pipeline Scan. To use it, select a finding in the Veracode Scan panel and choose the Fix option. Review the suggested patch before applying — fixes are not guaranteed to be complete or build-compatible in all cases.

Common Issues and Solutions

"Credentials not found" — Check your API credentials file exists and is in the default location. Docs: docs.veracode.com/r/c_api_credentials3

"Packaging failed" — Your project may need manual packaging. See packaging requirements for your language. Docs: docs.veracode.com/r/compilation_packaging

"Rate limit exceeded" — You've exceeded 6 scans per 60 seconds. Wait and retry. Use separate API credentials for different projects if running high volumes.

"Scan timed out" — Scans have a 60-minute maximum. Try scanning a smaller module or optimize your packaging.

Useful Resources

Learning Paths

Go deeper with these step-by-step learning paths on Veracode Docs:


← Back to the Getting Started Guide | ← Back to the Onboarding Hub