MPerrotti200599 (Community Member) asked a question.
We have a third party commercial DLL packaged with a web application, but Veracode is not fingerprinting this DLL. According to support, it cannot fingerprint DLLs from private NuGet repos. Is there any way that Veracode can support this DLL?
Since the file itself is being uploaded, and not just referenced by byte code, it would seem possible, but I am unsure how Veracode SCA works.
.png){kind=logo}
Hello @MPerrotti200599 (Community Member) ,
There wouldn't be any way to report on a flaw on this library, but if you use the Agent-Based SCA scan it will report it as an unmatched library. While this may not show up as a warning or a red flag, it could prompt more investigation that could help lead to identifying issues like this sooner.
The library should show up as unmatched. There is an example in a Help Center Article: https://help.veracode.com/r/hHHR3gv0wYc2WbCclECf_A/2fDFsrT1yu~383NjA~ZiTw
We also have more information on the Agent-Based scans in this Help Article: https://help.veracode.com/r/hHHR3gv0wYc2WbCclECf_A/WV3d2AOJdY1z1B65IL2ztg
Jason
Veracode Support Engineer