LMoore110681 (Community Member) asked a question.
I have an application, which is used in different countries which, because of internal companies rules, requires a different application in VeraCode for each country. For instance AppX_Italy, AppX_Spain, etc.
There is a new release of the application every month, but countries can be on different versions.
for instance AppX release 1.11, but Spain decides to stay on 1.10, while Italy updates to 1.11. We require the country to have a new VeraCode static scan for each release they move to. This adds massive overhead as each country that upgrade requires a new scan, and then there can be mitigation that need to be copied need to be copied across multiple country scans.
So I want to know if I can have an AppX application, which has a static scan report for each release, with mitigations, etc., which can be fully copied as required to each country application within VeraCode?
.png){kind=logo}
Hello @LMoore110681 (Community Member) ,
If you are using static pipeline scan, then each country could run a scan to establish a baseline file, remove the flaws from the file that are country specific, and pass that file to future scans. This method will help filter out common flaws and pass their pipelines.
There are more details on using baseline files with pipeline scan in the help center article Using a Pipeline Scan Baseline File.
Jason
Veracode Support Engineer