Hello @LPhan261272 (Community Member)​,

Thank you for your question. I generally find that the Triage Flaws page has a lot more information than is presented in the PDF compliance reports. The Triage Flaws page is most useful for understanding what the exact cause of the flaw was, and for specific remediation guidance. Once you have found the corresponding flaw on the Triage Flaws page, you want to click the little black arrow icon (next to the check box) to expand the Flaw Details. Typically the Attack Vector will then tell you which method or variable has caused this to be raised.

We first need to understand why Veracode has reported the flaw, and that is what the Triage Flaws page is for. Once we know what condition has caused this to arise, we may then look to our options. Typically this flaw is raised because we observe something sensitive-looking leaving your application. Perhaps it may be a URL we are constructing here (as an example) and so the base-part of the URL may come from configuration. If that is the case, we could look to propose a Mitigation By Design, documenting where the base-URL has come from, and attesting that nothing sensitive and unexpected is leaving the application at this location.

Does that answer your question?

Thanks,

Anthony Fielding