SAST Onboarding Path

SAST Onboarding Path

This guide walks you through everything you need to get Veracode Static Analysis (SAST) running for your team — from your first application profile to automated scanning in CI/CD. Follow the steps in order for the smoothest setup experience.


What you will need before you start:

  • A Veracode account with the Security Lead, Creator, or Submitter role
  • Your API credentials (API ID and Secret Key) — generated from your Veracode user profile
  • A compiled build artifact or source repository you want to scan

Docs: Generate API Credentials  |  User Roles and Permissions

Step 1 — Create Your Application Profile

Every application you scan in Veracode needs a profile. The profile stores your scan history, policy assignment, and settings for that application. Think of it as the container for all scan results and compliance status for a given codebase.


What to do:

  • In the Veracode Platform, go to Applications and select New Application
  • Name the application clearly — use a name your team will recognize (usually matches the repo or project name)
  • Set the Business Criticality to reflect its importance (Very High for customer-facing or compliance-scoped apps)
  • Assign a Security Policy — this determines what findings must be fixed and your compliance threshold
  • Add any custom fields or tags that help your team identify the application (team name, product line, etc.)

Docs: Create an Application Profile  |  About Business Criticality  |  Built-in Security Policies



Tip: Start with one application before creating profiles for your entire portfolio. Scanning one app first helps you understand the workflow before scaling.


Step 2 — Package Your Application for Scanning

Veracode SAST analyzes your compiled build artifacts — not raw source code. Packaging means preparing the right files in the right format for the scan engine to analyze. The packaging requirements vary by language, but Veracode provides detailed guidelines and tooling to help.


Your two main options:

Option A — Auto-packaging with the Veracode CLI

The Veracode CLI can attempt to auto-package your application from source. This is the fastest way to get started:

veracode package --source . --output ./veracode-artifact --trust


Option B — Manual packaging

If auto-packaging does not work for your project, or you need more control over what is included, package manually following the guidelines for your language in Veracode Docs.

Docs: Packaging Guidelines  |  Packaging Quick Reference by Language  |  Packaging Cheat Sheet  |  Supported Languages for SAST


Packaging is the most common stumbling block. If your first scan returns prescan errors or empty results, the Veracode Docs packaging guidelines are the first place to look. The Prescan Errors reference lists common issues and how to resolve them.



Step 3 — Run Your First Scan

Veracode offers two main methods for SAST. Choose based on your workflow — many teams use both.


Upload and Scan — policy-tracked, results in the platform

Upload your build artifact directly in the Veracode Platform or via API. Veracode runs the scan in the cloud and publishes results to your application profile. This is the method that counts toward policy compliance.

Docs: Upload and Scan  |  Upload a Packaged Application


Pipeline Scan — fast, developer-first, results in your terminal or CI/CD

Pipeline Scan runs via the Veracode CLI and returns results directly to your pipeline or terminal — typically within minutes for most codebases. It is designed for fast developer feedback in the development workflow and does not require a pre-created application profile.

veracode static scan ./your-application.jar

Docs: Pipeline Scan with the CLI  |  Pipeline Scan Supported Languages


Note on scan speed: Pipeline Scan is optimized for fast feedback and typically returns results within minutes. Upload and Scan run time depends on application size and complexity. The Veracode platform will show you an estimated completion time during the scan.


Step 4 — Read Your Results

Once your scan completes, Veracode returns a list of findings — potential security vulnerabilities in your code. Understanding how to read and triage these results is a key skill for your security team and developers alike.

Key concepts to understand:

  • Severity levels: Very High, High, Medium, Low, Informational — your policy determines which levels must be fixed
  • CWE reference: Each finding is mapped to a Common Weakness Enumeration (CWE) category — useful context for understanding what the finding means
  • Policy pass/fail: The overall compliance status of your application against its assigned security policy
  • Flaw status: New, Open, Fixed, Mitigated — track the lifecycle of each finding over time
  • Module selection: For large applications, you may need to specify which modules to include in the scan


Community Guide: Reading Your Scan Results  |  Docs: Best Practices for Reviewing Findings  |  About Top-Level Modules


First scan perspective: It is normal to see a large number of findings on your first scan. This is your baseline — the starting point, not the end state. Most mature Veracode programs started exactly here.



Step 5 — Set and Refine Your Security Policy

Your security policy determines what your program actually requires developers to fix. Policies are the governance mechanism that make Veracode more than a scanning tool — they define the security bar for your organization.

  • Review how your applications are performing against the policy you assigned in Step 1
  • If the compliance bar feels unreachable with your current flaw count, consider a grace period adjustment — give teams time to work down existing findings before tightening requirements
  • If you want to customize beyond the built-in policies, create a custom policy scoped to your organization's risk tolerance
  • Document your policy decisions so that new developers and stakeholders understand the program requirements


Docs: Security Policies Learning Path  |  Built-in Policies  |  Set Default Policies


Step 6 — Connect Your IDE

Veracode IDE plugins let developers find and fix security issues without leaving their editor. Results appear inline in the code — directly on the lines where vulnerabilities exist. This is the fastest feedback loop for developers and the most effective way to build secure coding habits over time.


Available IDE plugins:

  • Visual Studio Code
  • JetBrains IDEs (IntelliJ IDEA, PyCharm, GoLand, and more)
  • Visual Studio
  • Eclipse

IDE plugins run both SAST (Pipeline Scan) and SCA findings directly in your editor. They also surface Veracode Fix suggestions — AI-generated code fixes you can apply with a single click.


Community Guide: IDE Plugins and Your First Scan  |  Docs: IDE Plugins Overview  |  Scan and Fix in Your IDE Learning Path


Veracode Fix: When the IDE plugin surfaces a SAST finding, Veracode Fix can suggest a code fix in context. Developers can review and apply the fix directly from the IDE. Fixes are AI-generated and reviewed before applying — you stay in control of the final code change.

Docs: Veracode Fix


Step 7 — Automate with CI/CD

The final step is embedding Veracode into your build pipeline so that every code push or pull request triggers a scan automatically. This is how mature AppSec programs scale — manual scan submission becomes the exception, not the rule.


Getting started with CI/CD integration:

  • The Veracode CLI installs in a single command inside most CI/CD environments
  • Store your API credentials as environment secrets in your pipeline — not in code
  • Start with a non-blocking scan (returns results but does not fail the build) until your team is comfortable with the workflow
  • Once teams are confident, configure the scan to fail builds that introduce new Very High or High findings

Minimal GitHub Actions example:

- name: Install Veracode CLI

  run: curl -fsS https://tools.veracode.com/veracode-cli/install | sh


- name: Run Pipeline Scan

  run: ./veracode static scan your-application.jar

  env:

    VERACODE_API_KEY_ID: ${{ secrets.VERACODE_API_KEY_ID }}

    VERACODE_API_KEY_SECRET: ${{ secrets.VERACODE_API_KEY_SECRET }}


Community Guide: Getting Started with the Veracode CLI  |  Docs: Integrate with CI/CD  |  Integration Pathways Guide


What's Next


Back to the Onboarding Hub