As mentioned a couple weeks ago on July 6th (link to post), Veracode made changes to how the First Found Date is calculated for SCA findings. As promised, this week we will be rolling out a new field to the Analytics platform, Library First Found in Active Scans, which will be the first time a given library version was detected in an SCA scan.

Additionally, due to unintended consequences of adjusting the First Found Date definitions, we will be rolling out the following changes around the same time:

• Report null Finding Age and Time to Remediate for findings that were closed before a vulnerability was published
• Reinstate the Reopened Date field for SCA findings

If you have any questions or concerns, please comment below. Thank you!