FRuvalcaba239831 (Community Member) asked a question.
What is the best way to Scan Project references or Nuget Packages in .net
We have many internal .net nuget packages or project references, that show up as flaws in scans. Since it is a project reference, should we:
- fix the issue on the "Service A" that was scanned. This presents another issue, if a referenced DLL is scanned, we don't have the PDB (Symbols file), is there a way to get them in the output of Service A build?
- should that reference have it's own scan? If the referenced project is scanned, then some flaws are fixed that means that flaws in Service A are going to be fixed. But what about a flaw that is mitigated, will Service A scan know that the flaw has been mitigated?
What would be the best approach to handle this?
.png){kind=logo}
@FRuvalcaba239831 (Community Member)
If I understood corectly do you need scan libs built internally that are reference used by other apps right?
usually we upload DLLs created by compiler and scan with SAST that are reference for business rules apps
You can review all DLLs uploaded to scan: Veracode platform > app profile > Scans completed > choose a scan > Review modules
You'll see all Dlls uploaded. And you'll notice that are some of them that were selected as entry-point, it means that these were chosen to scan by SAST, and represents entry-points for external data, in other words, your business rules.
If these "Services" are independent application, you should upload and scan separately.
I recommend open a case with support to follow with you.