September 2026 Product Pulse: a new Static Analysis engine and more

The September edition of the Veracode Product Pulse newsletter is here. This month's headline is Static Analysis Engine v2026.09, released September 23 and generally available.

• Fewer false positives. The engine reduces false positives for CWE-259 and CWE-798 flaws.
• DryRun Security integration. Hybrid findings combine Veracode deterministic static analysis with DryRun contextual AI, surfacing security context during pull request and code review workflows.
• Enhanced Python scanner. Support for PySpark, Flask, Django, and FastAPI. If your team scans Python, you may see a one-time change in flaw matching, and previously applied mitigations might need to be reapplied.

Also in this issue: Veracode Fix for SCA (Limited Availability), Reachability Analysis in the Unified SCA Beta UI, a redesigned EASM interface, Azure DevOps Extension v4.0.0, and a new Security Labs lesson on the OWASP Top 10 for LLM applications.

👉 Read the full September newsletter

Want the technical details now? See the Static Analysis release notes on Veracode Docs.

October 1–6, 2026 brought a pair of releases for the Veracode community: a new dependency graph view in BetaUI and the latest GitLab Workflow Integration update. Here's what shipped and why it matters.

Dependency Graph in BetaUI

Released October 1, 2026

A new dependency graph is now available in BetaUI, giving teams a visual view of direct and transitive dependencies — the libraries an application relies on, plus the libraries those libraries pull in. The graph works for both Upload & Scan and Agent-based scans, making it easier to understand the full supply chain behind a project. One limitation to note: the dependency graph is available only for new scans performed on or after October 1, 2026.

GitLab Workflow Integration v2.1.9

Released October 6, 2026

GitLab Workflow Integration v2.1.9 is now live. This release adds support for the predependency_command parameter in veracode.yml, which lets teams run single-line or multiline commands before Veracode packages the project. It also adds support for the policy parameter under veracode_iac_secrets_scan: in veracode.yml, enabling Infrastructure-as-Code (IAC) scans to run with policy. A new feature blocks any merge request from merging when break_build_policy_findings and break_build_on_error are set to true, helping teams keep policy-violating code out of protected branches. SCA (Software Composition Analysis) scans in GitLab workflows have also been optimized. Release notes are available here, with documentation updates to follow.

For the full set of Veracode release notes, visit https://docs.veracode.com/updates/.

GitHub Workflow Integration — v2.1.7 adds custom IaC policies

Released September 23, 2026

GitHub Workflow Integration v2.1.7 adds support for custom policies for Infrastructure-as-Code (IaC) scans in the GitHub Integration flow. IaC scanning reviews the configuration files that define cloud infrastructure (such as Terraform or CloudFormation) for misconfigurations before they're deployed, and custom policies let teams enforce their own rules on top of the defaults. This has been a pending request from several customers, and ADO and GitLab support for the same capability will follow.

• Github Cloud FAQs (IAC Policy edge cases)

DAST — Multiple teams per target

Released September 23, 2026

Dynamic Analysis (DAST) now supports assigning multiple teams to a single DAST target when creating a web application or API specification. DAST scans running applications from the outside to find vulnerabilities attackers could exploit, and a "target" is the app or API being scanned. Letting more than one team own a target makes it easier for organizations to collaborate on security ownership across groups that share responsibility for an application.

• Documentation: Scan web applications
• Documentation: Scan APIs
• Release notes

For the full list of what's new, visit the Veracode release notes. Feedback on these releases is welcome — share thoughts and questions in the community.

The fix for the VeracodeFlawImporter task space migration is development-complete. It ships in our major release on 30 September 2026.

What's changing

This release removes the previously deprecated tasks.

What you need to do

• If you plan to upgrade to the 30 September release: Migrate to the new tasks before you upgrade. The deprecated tasks won't be available after the upgrade, so migrating early keeps your pipelines running.
• If you stay on an earlier version: You can keep using the existing (legacy) tasks.

More information

https://docs.veracode.com/r/Azure_DevOps_Extension

Released September 21, 2026

The first production release of EASM's completely rebuilt webapp is now live, introducing a modern, modular, and tailored customer experience. The new webapp becomes the official production UI, with refreshed navigation and a consistent experience across the platform that adapts to project type and enabled capabilities.

EASM (External Attack Surface Management) continuously discovers and monitors internet-facing assets so teams can see their exposure before attackers do. This release establishes a clear transition path away from the Legacy interface, which moves to bug-fix-only maintenance, while the new Standard experience becomes the official webapp.

On first sign-in, users can choose their environment — Legacy or Standard — and that selection is remembered for future sign-ins. Legacy can be re-selected at any time, giving teams flexibility during the transition.

• EASM docs
• Release notes

For the full list of what's shipped across Veracode, visit the Veracode release notes. 

Veracode Analytics introduces the IDE and CLI Usage Explore and Dashboard to visualize and explore your organization's IDE and CLI usage. For more information, see Pre-built Analytics Dashboards and IDE and CLI Usage explore data dictionary.

Note that events from the following IDE plugin versions display null error codes and messages:

• VS Code v1.16.2 and earlier
• Visual Studio v0.8.1 and earlier
• JetBrains v1.8.0 and earlier

To stay up to date when error codes and error messages become available in Analytics, follow Integration updates.

Next week's September Static Analysis Release includes the following:

Updated language and framework support

.NET

• Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives.

Android

• Enhanced support for Android 16.

Apple Platforms

• Adds support for iOS 27.

Go

• Adds support for Go 1.27.

PL/SQL

• Improves parsing of PL/SQL code and scan performance.

Python

• Improved detection of CWE-89 vulnerabilities in PySpark applications.
• Improved SQLAlchemy analysis to reduce false positives when detecting CWE-89 vulnerabilities.
• Improves detection of third-party code.

RPG

• Improved detection of CWE-200 flaws to reduce false positives.
• Improved analysis of CALL commands to enhance detection of CWE-252 flaws.

Other languages

• Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.