FRuvalcaba115755 (Community Member) asked a question.
For a .net framework static scan, does Veracode skip unused, but referenced DLLS?
I have a project that references many DLLs, but some of them are not used. Do the extra DLLs get scanned when I select the main entry point?
I'm doing the scan by uploading all built files to the sandbox.
.png){kind=logo}
Select only the binaries you want scanned for static analysis. Selecting 3rd party components may show flaws, in them, but if you don't have access to source code for them, you won't be able to determine if the findings are false positives.
Thanks for your answer. What would happen if a 3rd party component is referenced but not used by the project, and I don't select that 3rd party component as an entry point? Would Veracode skip it?
I should not be scanned for static analysis, but should reflect vulnerabilities in SCA findings.