Greetings all! I’m pleased to announce some new advanced rules for SCA component licenses have been added to Veracode policies. With the new rule types, in addition to disallowing components based on Veracode license risk, you can also disallow based on use of a non-open source license, an unrecognizable license, or due to the license being present on a blocklist or not being on an allowlist. The new rule types also allow you to explicitly control how a component with multiple licenses is evaluated with respect to other license rules.

These features have been requested for a while by customers who wanted finer grained controls over the open source licenses in use in their organization, and we are thrilled to bring them to a policy near you!More information about these features is available in the Help Center, and a short video walkthrough below shows the feature in action.