Hello @veer,

I see you also opened a ticket with our support team on this issue and I want to post the answer on the Community.

Please be aware, Greenlight and Policy Scans utilize the same static engine to find flaws. Since Greenlight is typically scanning just one compiled module or class file, the scanner does not have the same application scope as a full policy scan. In some cases Greenlight may not be able to detect flaws using data flow analysis as tainted data is traced between sources and sink. There can also be compiler optimizations such as removing unused variables that can mask flaws in a single module that can be detected in a full application scan. The Static Express engineering team is responsible for Veracode’s cloud service behind the Greenlight product and are not experts in this area. 

If you want to understand the reason specific examples of flaws are not detected please engage with the Veracode Application Security Consultant team to get more information about your modules.

Please use the following link to find additional information on scheduling a consultation call: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/7YQTCDJKFEQzL3gL_N90hQ

If the information we’ve provided you has helped resolve your challenge (or answered your question), we would appreciate it if you could mark the response that was helpful with “Select as Best”. This will help other Community members who come across your question as a similar challenge they might be facing and your best answer will help them find the right solution as well.

Thank you,

Steven

Veracode Support Engineer