hi @NEnrico563158 (Community Member)​ - This is expected behavior when the Pipeline Scan (SAST) fails to package your project, here's what occurs -

The plugin runs two completely separate scan engines:

SCA Agent-based Scan – reads your pom.xml directly to identify vulnerable dependencies. No compilation is required, so this always runs successfully.

Pipeline Scan (SAST) – analyzes your actual Java code for security flaws. Before it can scan, the autopackager must compile and package your project by running mvn clean package. If packaging fails, the Pipeline Scan is skipped entirely and "Flaws in My Code" will show nothing — even though SCA still succeeds.

The most common causes for packaging failure on a Maven/Java project are:

1. mvn is not on your PATH or JAVA_HOME is not set correctly
2. The project does not compile successfully without errors (check by running mvn clean package in your terminal from the project root)
3. The pom.xml is missing or misconfigured
4. The project is a monorepo — the plugin does not support monorepos
5. Required build tools or dependencies are not installed on your local machine

To diagnose the issue:

1. Open a terminal and run mvn clean package from your project root. If this fails, fix any build errors first.
2. Verify that the mvn command is available on your default command-line prompt (the same environment your IDE uses) and that JAVA_HOME points to the correct JDK.
3. Enable debug mode in the plugin (from the Veracode Scan window dropdown → Enable Debug) before scanning, then check the logs in .veracode/ide_agent/jetbrains/ for details on why the packaging may have failed.
4. Alternatively, you can manually package your project (run mvn clean package yourself) and place the resulting JAR/WAR/EAR in a .verascan folder at your project root. The plugin will use that artifact directly instead of trying to autopackage.

Hope that helps get you unblocked!