Getting Started with Veracode

New to Veracode or looking for foundational knowledge? Start here!

Foundational Resources

• Get Started with Veracode (Includes links to our product Quickstart Guides) Est. 5–15 min
• Veracode Learning Paths (Overview) Reference / Portal
• Basics of the Veracode Platform Est. 5–15 min
• Veracode Docs Center Reference / Portal
• Veracode Glossary Reference / Portal
• Veracode Videos Reference / Portal

Getting Started Guides Updated

We've created these guide pages to help explain Why & How you would use our products to accomplish your goals.

• Getting Started Guide Start here
• Your First 30 Days ✨ New Est. 15–30 min
• Platform Setup Essentials ✨ New (users, roles, teams, API credentials)
• Remediation Planning ✨ New (prioritize and assign fixes)
• Scan Types & Workflows ✨ New (SAST, DAST, SCA, Pipeline Scan — which to use when)
• Secure the SDLC with Veracode (where we fit, end-to-end)
• Application Security Testing Developer Workflow (scan → fix → verify)
• IDE Scanning (find flaws while you code)
• Repo / CI Scanning (automate scans in your pipelines)
• Package Firewall (block risky open-source dependencies)
• Veracode Risk Management (VRM) (prioritize, track, report)

Developers & Engineers

Resources tailored for developers, security champions, and anyone directly interacting with code scanning and remediation.

General Developer Guidance

• Guide for Developers ✨ New Est. 15–30 min
• IDE Plugins & Your First Scan ✨ New Est. 10–20 min
• Reading Your Scan Results ✨ New Est. 10–15 min
• Best Practices for Reviewing Findings Est. 5–15 min
• Searching for a specific flaw in the Triage Flaws page Est. 2–5 min
• Verifying your Fixes Est. 5–15 min
• Resolve prescan warnings and errors Est. 5–15 min

Static Analysis (SAST)

• Static Analysis Learning Path Est. 30+ min / Series
• Static Analysis Quickstart Guide Est. 2–5 min
• Reference for Package Requirements Est. 5–15 min
• Packaging Guidelines Est. 15–30 min
• Packaging Cheat Sheet Est. 2–5 min
• About Auto-packaging Est. 2–5 min
• Upload a packaged application (File size limits) Est. 2–5 min
• SAST Upload and Scan Supported Languages Est. 2–5 min
• SAST Pipeline Scan Supported Languages Est. 2–5 min
• About Prescan Verification Est. 5–15 min
• About Top-Level Modules Est. 5–15 min
• Select Modules to Scan for Veracode Static Analysis Est. 2–5 min
• Viewing Changes between File Uploads Est. 2–5 min
• Reviewing the Static Scan Details Est. 5–15 min
• Reviewing the Estimated Completion Time Est. 2–5 min
• Mobile Behavioral Analysis (findings for mobile apps) Est. 5–15 min

Scan & Fix in Your IDE (Veracode Greenlight & IDE Plugins)

• Scan and Fix in your IDE Learning Path Est. 30+ min / Series
• IDE Plugins and Extensions (Also listed under Integrations) Est. 5–15 min
• Greenlight Best Practices Est. 5–15 min

Veracode Dynamic Analysis (DAST)

• DAST Learning Path Est. 30+ min / Series
• DAST Essentials Quickstart Guide Est. 2–5 min
• Best Practices for Dynamic Analysis Web Applications Est. 5–15 min
• ISM Endpoint Best Practices Est. 5–15 min
• Selenium Script Best Practices Est. 5–15 min

Veracode Software Composition Analysis (SCA)

• SCA agent-based scan Learning Path Est. 30+ min / Series
• SCA agent-based scan Quickstart Guide Est. 2–5 min
• SCA CI/CD Best Practices Est. 5–15 min
• SCA Create Agent Est. 2–5 min
• SCA Agent-Based Scans Supported Languages Est. 2–5 min
• SCA Upload Scans Supported Languages Est. 2–5 min
• SCA Container Scanning Est. 5–15 min
• SCA Agent-Based Commands Reference / Portal
• SCA CI Script Est. 5–15 min
• SCA Auto-Pull Requests Est. 5–15 min
• IaC Container Scanning Est. 5–15 min

Veracode Fix (AI code flaw remediation)

• Fix Quickstart Guide Est. 2–5 min
• About Veracode Fix Est. 5–15 min

Veracode Package Firewall (formerly known as Phylum)

• Package Firewall docs and list of Supported ecosystems Est. 2 min
• Package Firewall product updates Est. 2–5 min
• Connect Package Firewall to package ecosystems Est. 2–5 min

Security Labs

• Security Labs Learning Path Est. 30+ min / Series

For DevOps & Automation Engineers

Focus on integrating Veracode into your CI/CD pipelines and automating security tasks. Many links from the "Developers" section are also relevant here, especially regarding specific scan types.

Veracode CLI

• DevOps Engineer Guide ✨ New Est. 15–30 min
• Veracode CLI docs Est. 15–30 min
• Install the Veracode CLI Est. 2–5 min
• CLI Reference Reference / Portal
• Integrate the CLI with your CI/CD Est. 5–15 min
• Integrate Static Analysis with the CLI Est. 5–15 min
• CLI exit codes Est. 2–5 min
• Uninstall the CLI Est. 2–5 min

Veracode Integrations & APIs

• Integration Pathways Guide ✨ New Est. 10–20 min
• Integrate with Veracode (Overview) Est. 5–15 min
• Veracode API Specification Reference / Portal
• API Best Practices Est. 5–15 min
• REST API Quickstart Guide Est. 2–5 min
• IDE Integrations (Also listed under Developers) Est. 5–15 min
• CI/CD Integrations Est. 15–30 min
• Ticketing Integrations Est. 5–15 min
• WAF Integrations Est. 5–15 min
• GRC Integrations Est. 5–15 min
• Chat Tool Integrations Est. 5–15 min
• GitHub App Workflow Documentation Est. 5–15 min
• Azure DevOps App Documentation Est. 5–15 min

Repos — Open Source — Community

Connect with the wider Veracode community and explore open-source projects.

• Veracode GitHub repo Reference / Portal
• Veracode GitHub Community Projects Reference / Portal
• Veracode GitHub Open Source Projects Reference / Portal
• Veracode Manual for GitHub Reference / Portal
• Veracode Manual for GitLab Reference / Portal

For Program Managers & AppSec Leads

Resources for planning, managing, and optimizing your application security program.

Program Kickoff & Foundation

• Program Owner Guide ✨ New Est. 15–30 min
• Security Lead Guide ✨ New Est. 15–30 min
• Team Administrator Guide ✨ New Est. 15–30 min
• Analytics & Reporting ✨ New (dashboards, metrics, leadership reports)
• Kicking off your Veracode program: Get Started with Veracode Est. 5–15 min and Basics of the Veracode Platform Est. 5–15 min
• Developing a Remediation Plan Est. 5–15 min
• Application Security Best Practices (General) Est. 5–15 min
• About Veracode Rules for Data Retention and Archiving Est. 5–15 min

Program Management, Reporting & Business Reviews

• Create an Analytics Dashboard Est. 5–15 min
• Customize Visualizations Est. 5–15 min

Consulting & Support

• Understanding Veracode Mitigation Proposal Reviews Est. 5–15 min
• Schedule a Consultation Action Link
• Schedule a Next-Day Consultation Action Link