evalle (Partner) asked a question.
What is the best approach to do a SAST scan on a complete application (front, core, back)?
Considering an application where each module it's build on different technologies
In order to have a complete coverage of possible vulnerabilities, is it better to scan each module independently?, saying it in another way, create an application profile for the front (java), other profile for the core (C++) and one more for the back (cobol)? or is it better to create a bundle of the application and scan it?
.png){kind=logo}
Hi @evalle (Partner) , the Veracode static analysis engine creates a model within the scope of the deployed artifact and does not follow data and control flow across executable code boundaries. So the results you get from scanning the example application as three separate application profiles should be exactly equivalent to what you get from scanning them in a single application profile.
The only benefit today from doing them in a single application profile is the ability to generate a single PDF report. We are working on a capability to provide reporting across multiple application profiles but that's not yet available today.
Thanks for the information @Tim J (Veracode PM) (Veracode)