Hi everyone,

We’re trying to extend our Veracode usage to cover more of our internal apps and microservices, but we’re limited by the number of application profiles allowed under our current license.

Right now, only a few core apps are being scanned. We’d like to scan additional apps — even if it’s not a full policy scan, but just a way to run static analysis (SAST) and review potential findings internally.

I understand that sandboxes are tied to a specific application profile. My question is:

Can we scan multiple distinct apps under different sandboxes of a single application profile — for example, using a unique sandbox per app — even if they aren’t part of the same codebase?

The intent is to:

• Run static scans on each app
• Use sandboxes to isolate the results
• Avoid triggering policy evaluations
• Provide visibility to our security team

Has anyone used sandboxes this way? Are there any official guidelines or licensing constraints that prevent this approach?

Thanks in advance!