Hi @cyoung144894 (Community Member)​ ,

Veracode Static Analysis Pipeline and Veracode Static Analysis Policy run the same engine and should produce the same flaws.

If you're experiencing a difference I would recommend checking the same binary is uploaded and review the entry point selection. You can view this for Policy scans in the Veracode Platform by clicking a specific scan and then navigating in the menu on the left hand side to "Review Modules".

For the Pipeline scan with the dedicated Java CLI this would be the `-i` or `--include` .

Please note that `veracode static scan` with the Veracode CLI does not yet support module configuration and uses the default module selection.

If this does not resolve the discrepancy I would recommend you contact our technical support team. Here's how you can log a case:

1. Navigate to the upper right corner of any page in the Community, click on your user avatar.

2. Select Contact Support from the drop-down menu.

Thank you,

Boy Baukema

Hi @Boy, Security Consultant (Veracode)​,

We have ensured that the same codebase and configurations are used in both scenarios to eliminate potential differences. Despite these efforts, the inconsistency persists. I would appreciate your assistance in understanding the root cause of this issue and finding a resolution.

Additionally, I have some other queries:

1. Using the upload and scan actions method, will we be able to retrieve the scan results in our CI pipeline? If so, could you please guide how to achieve this?
2. Is there any upcoming feature for the pipeline scan to have the results in the portal? We are interested in having a seamless integration of pipeline scan results into the Veracode portal.