TruthNotTruth (Community Member) asked a question.
What are the primary differences between a static and pipeline scan
We use Azure DevOps with integrated scanning, however the documentation doesn't look to give enough information to influence whether one should only perform pipeline scans (because they're faster and can be used to break builds) or static analysis. Is there an argument to be made that only pipeline scans should be used?
.png){kind=logo}
Hi @TruthNotTruth (Community Member) ,
Pipeline scans and Policy scans are both ways to scan using Veracode Static Analysis. The main difference between them is 'reporting'. The Pipeline scan skips reporting the flaws to the Veracode Platform and performing our 'flaw matching' functionality. This means it's faster, but at the cost of insight. It it typically a trade-off you would make for purposes of 'shifting left'. Pipeline scans work great on Merge Requests or frequent scans where you just want to know 'did I introduce a new flaw'. Policy scans however work better as a way to give your security team insight into the security status of an upcoming release.
Depending on your contract you may be entitled to work with a Veracode Customer Success Engineer who can help you with mapping our capabilities unto your development and deployment process. I would recommend you contact our technical support team. Here's how you can log a case:
1. Navigate to the upper right corner of any page in the Community, click on your user avatar.
2. Select Contact Support from the drop-down menu.
Thank you,
Boy Baukema
I'm currently seeing an issue where CWE-80 is not detected on the pipeline, but the same code packages the exact same way will test positive with a polity scan
The advice I got from someone on the platform side was to hack the policy scan, parse the output and make pass fail decisions from there 😠
so per Veracode, there is an argument to be made to only use the policy scan! But I really wish they would fix this. Its continually frustrating to work with this product