This guide walks you through how to read your results, what the key terms mean, and how to decide what to act on first.
Where to Find Your Results
- Veracode Platform — My Portfolio > Applications > View Results. Most complete view for all scan types. Docs: docs.veracode.com/r/review_results
- Your IDE — Findings appear inline in your editor alongside the relevant code.
- CI/CD pipeline — Results appear in pipeline logs and as a results.json file (Pipeline Scan).
Understanding Scan Types and Their Results
- Static Analysis (SAST) — Scans compiled application code for vulnerabilities. Results are called "flaws." Docs: docs.veracode.com/r/c_static_overview
- Software Composition Analysis (SCA) — Scans open-source dependencies for known vulnerabilities. Results are called "vulnerabilities" or "issues." Docs: docs.veracode.com/r/Software_Composition_Analysis
- Dynamic Analysis (DAST) — Tests your running web application. Results are called "flaws." Docs: docs.veracode.com/r/Dynamic_Analysis
Severity Levels Explained
| Severity | What It Means | What To Do |
|---|---|---|
| Very High (5) | Critical risk — attacker could gain significant control or access | Prioritize immediately |
| High (4) | Significant risk — could lead to data exposure or privilege escalation | Fix as soon as possible |
| Medium (3) | Moderate risk — exploitable under certain conditions | Plan fix within normal sprint cycle |
| Low (2) | Limited risk — harder to exploit or limited impact | Fix when time allows |
| Very Low (1) | Informational — often coding best practice issues | Address during routine code quality work |
Start Here: Focus on Very High and High severity findings first. These are most likely to represent real risk and to affect your policy compliance status.
Policy Status: Pass or Fail
Every application in Veracode is assessed against a security policy. The policy defines rules like: "All Very High severity flaws must be fixed within 30 days." If your results include findings that violate these rules, your application fails policy.
Failing policy on your first scan is completely normal — it just means you have work to do.
- Docs: About Security Policies
The Triage Flaws Page
For Static Analysis and Dynamic Analysis results, the Triage Flaws page in the Veracode Platform is your working view for managing findings. Here you can filter by severity, add comments, propose mitigations, and mark findings as addressed.
- Docs: Triage Flaws
Understanding Mitigations
When you find a vulnerability you can't or won't fix immediately, you can propose a mitigation. Types include: Mitigated by Design, Potential False Positive, OS Environment, and others. A user with the Mitigation Approver role must approve mitigations before they count toward policy compliance. This is a separate, dedicated role — not automatically part of the Security Lead role.
- Docs: Propose Mitigations
Veracode Fix: AI-Assisted Remediation
Veracode Fix is an AI-assisted remediation tool that generates suggested code patches for findings discovered by Pipeline Scan. It is available in all four modern IDE plugins (VS Code, JetBrains, Visual Studio, Eclipse) and can be integrated into GitHub Actions workflows via the Veracode CLI. Always review suggested fixes before applying. Note: Veracode Fix resolves Pipeline Scan findings only — it does not apply to Upload and Scan findings. A Veracode Fix license is required.
- Docs: About Veracode Fix
Generating a Report
- Detailed Report (PDF) — Comprehensive findings for a specific application. Docs: docs.veracode.com/r/c_results_reports
- Customizable Report (PDF) — Choose which sections to include — good for executive summaries.
- Findings Report (API/CSV) — Programmatic export for custom analysis. Docs: docs.veracode.com/r/Reporting_REST_API
Learning Paths
Go deeper with these step-by-step learning paths on Veracode Docs:
← Back to the Getting Started Guide | ← Back to the Onboarding Hub
.png){kind=logo}
