DKp612506 (Community Member) asked a question.
I have made the flaw as false positive and approved the mitigation with proper justification. Will the error still be visible? Is there anything I have to do after the mitigation has been approved?
- SamHouston (Veracode)
Hi there!
This page should be helpful here: https://docs.veracode.com/r/improve_mitigation
"Accepting the mitigated flaws removes them from the application score calculation and from being considered in the determination of the application's policy status. The mitigating factors are included in the application report."
If you open an ENG ticket for that it may go away when we change the engine rules.
Expand Post - DKp612506 (Community Member)
Hi,
Thanks for the information. I also wanted to know one more thing. I have run the scan and downloaded the scan results after making the flaws as false positive. But in the report, I can see that there are no flaws but instead it shows as fix required by policy. Do i have to do anything about it? or can it be required
- SamHouston (Veracode)
Hi there!
If there is a flaw that affects policy, it will likely show as 'fix required by policy', so it's as if you are seeing flaws.
It might be that there is a flaw, it is marked as 'fix required by policy' and you have proposed a mitigation. The next step would be getting that mitigation approved and the flaw would still be shown, but would not affect the policy.
Expand Post
.png){kind=logo}
Hi there!
This page should be helpful here: https://docs.veracode.com/r/improve_mitigation
"Accepting the mitigated flaws removes them from the application score calculation and from being considered in the determination of the application's policy status. The mitigating factors are included in the application report."
If you open an ENG ticket for that it may go away when we change the engine rules.