Integration Pathways

Connecting Veracode to your development tools and pipelines

Veracode integrates with the tools your teams already use. This hub maps out the integration landscape and points you to the right resources based on your toolchain.

Integration Categories


IDE Plugins

Scan from inside your development environment. All four modern Veracode Scan plugins support SAST, SCA, and Veracode Fix.

Plugin Docs
Scan for JetBrains docs.veracode.com/r/Scan_for_JetBrains
Scan for VS Code docs.veracode.com/r/Veracode_Scan_for_VS_Code
Scan for Visual Studio docs.veracode.com/r/Veracode_Scan_for_Visual_Studio
Scan for Eclipse docs.veracode.com/r/c_ide_eclipse

Note: All four modern Veracode Scan plugins (VS Code, JetBrains, Visual Studio, and Eclipse) can only be installed on one machine per user account. Installing a plugin on multiple machines may cause authentication failures with Veracode. See the plugin-specific Docs pages for details.

All IDE Integrations: docs.veracode.com/r/IDEs | Community: IDE Plugins & Your First Scan

Source Code Management (SCM) Integrations

Trigger scans automatically from repository events like pull requests and merges.

Platform Integration Docs
GitHub GitHub Workflow Integration (SAST, SCA, Container Security) + GitHub Actions docs.veracode.com/r/SCM_integrations
GitLab GitLab Workflow Integration docs.veracode.com/r/SCM_integrations
Bitbucket Bitbucket Workflow Integration docs.veracode.com/r/SCM_integrations

CI/CD Build Tool Integrations

Add security scanning to your automated build and deployment pipelines.

Tool Integration Docs
Jenkins Veracode Jenkins Plugin docs.veracode.com/r/c_about_jenkins
Azure DevOps Azure DevOps Extension docs.veracode.com/r/Azure_DevOps_Extension
TeamCity TeamCity Plugin docs.veracode.com/r/c_about_teamcity
Bamboo Bamboo Plugin docs.veracode.com/r/c_integration_buildservs

All CI/CD Integrations: docs.veracode.com/r/c_integration_buildservs

Issue Tracking Integrations

Import Veracode findings directly into your existing bug and issue tracking workflows.

Tool Docs
Jira Cloud docs.veracode.com/r/c_jira_cloud_about
Jira Server/Data Center docs.veracode.com/r/c_jira_cloud_about

API Access

For custom integrations or automation beyond the available plugins, Veracode offers a full REST and XML API suite.

Common Integration Recipes

Not sure how the pieces fit together? These worked examples show how real teams typically assemble Veracode integrations for three common toolchain profiles. Each recipe is a starting point — your setup may vary, but these give you a model to build from.

Recipe 1 — GitHub-Native Team, Developer-First Feedback

Profile: Small to mid-size team, GitHub for source control, focused on getting findings to developers early.

How it fits together:

Developers scan from their IDE (VS Code or JetBrains) as they code. On every pull request, a Pipeline Scan runs automatically via the GitHub Workflow Integration, failing the PR if new High or Very High findings are introduced. Upload and Scan runs nightly on the main branch and publishes policy-tracked results to the Veracode Platform. SCA runs automatically alongside Upload and Scan, and optionally via the CLI in the PR pipeline for open-source dependency coverage.

What you need:

  • Veracode IDE plugin installed for each developer
  • GitHub Workflow Integration configured on your repository
  • Pipeline Scan added as a GitHub Actions step on pull requests
  • Upload and Scan scheduled as a nightly build step
  • API credentials stored as GitHub Secrets

Relevant Docs:

Recipe 2 — Azure DevOps Team, Compliance-Focused

Profile: Enterprise team using Azure DevOps, with policy compliance and audit reporting as primary goals.

How it fits together:

Upload and Scan runs as a stage in the Azure DevOps release pipeline, triggered on each build targeting a release branch. The Azure DevOps Extension handles submission and result retrieval. Findings can be imported into Jira via the Veracode Jira integration, or tracked in Azure Boards via the Azure DevOps integration — these are separate integrations. DAST is scheduled weekly against the staging environment for externally-facing applications. Policy results and compliance trends are monitored in Veracode Analytics by the Security Lead.

What you need:

  • Veracode Azure DevOps Extension installed in your Azure DevOps organization
  • Application profiles created in the Veracode Platform with appropriate policies assigned
  • DAST target URLs and authentication credentials configured
  • Analytics access for Security Lead role holders

Relevant Docs:

Recipe 3 — Jenkins Pipeline, Multi-Language Monorepo

Profile: Team with an established Jenkins pipeline, multiple languages in one repository, needs flexible scan configuration.

How it fits together:

The Veracode Jenkins Plugin submits Upload and Scan jobs after each successful build. Pipeline Scan runs as a parallel stage for fast feedback on pull requests using the Veracode CLI. SCA Agent-Based Scan runs via the CLI against each language subdirectory in the monorepo. Results from all scan types are consolidated in the Veracode Platform, with findings exported to Jira via the Jira integration for team-level remediation tracking.

What you need:

  • Veracode Jenkins Plugin installed on your Jenkins instance
  • Veracode CLI installed on your Jenkins agent
  • SCA workspace configured per language or team in the Veracode Platform
  • Jenkins credentials store configured with Veracode API credentials
  • Jira integration configured for finding export

Relevant Docs:

Choosing Your Integration Path

A practical recommendation based on where you are:

Just getting started? → Begin with an IDE plugin for your developers while you plan your pipeline strategy.

Building a pipeline? → Use Pipeline Scan for pull request checks and Upload and Scan for nightly policy-tracked scans.

Scaling across many repos? → Use the GitHub or GitLab Workflow Integration for broad, automated coverage without per-repo configuration.

Need findings in your ticket system? → Set up the Jira integration to automatically create issues from scan findings.

Learning Paths

Go deeper with these step-by-step learning paths on Veracode Docs:


← Back to the Getting Started Guide | ← Back to the Onboarding Hub