A fresh batch of platform updates just landed across the Veracode portfolio. Here's what's shipped since August 5th — from smarter scan notifications to sharper DAST targeting and a more capable packaging runner for GitHub and GitLab integrations.

EASM: Real-Time Scan Event Notifications

Released August 5, 2026

External Attack Surface Management (EASM) now sends real-time, in-app notifications the moment a scan completes, fails, or gets cancelled. No more manually refreshing scan status — security teams get an immediate signal, keeping threat surface monitoring responsive and shrinking the gap between detection and action.

Notifications show up directly in the EASM interface, so teams can track scan outcomes without ever leaving the workflow.

• Learn more: EASM documentation
• Release notes: EASM release notes

DAST: Business Unit Targeting and Scan Engine Enhancements

Released August 6, 2026

Dynamic Analysis (DAST) now lets teams assign a business unit when creating a web application or API specification target — or straight from the DAST configuration page. That makes it simple to organize and filter scan targets by business unit, a real win for organizations that need to align application security reporting with internal team and ownership structures.

The DAST scan engine also got sharper, with improved detection for CAA record checks on SSL certificates for CWE-862 — applied across both Dynamic Analysis and DAST. Better detection means more accurate identification of certificate-related misconfigurations, so teams can close gaps before they're exploited.

• Documentation: Scan web applications (DAST) | Scan APIs
• Release notes: Web Application Scanning release notes

GitHub Workflow Integration: Check Runs Bug Fix (v2.1.2)

Released August 6, 2026

A minor release of the GitHub Workflow Integration (v2.1.2) fixes a bug where GitHub APIs weren't updating and reflecting the correct check runs status. With the fix in place, check run results now display accurately in GitHub — so developers and security teams can trust the status shown right in pull requests and commit views.

Runner Image scm-packaging-5.0.0: Expanded Packaging for GitHub and GitLab

A new default runner image — scm-packaging-5.0.0 — is now available for GitHub and GitLab repository integrations, replacing scm-packaging-3.0.0

. The updated image brings a broad refresh of underlying components, expanding support for a wider range of project types and increasing overall project coverage across repo workflows.

Updated components include:

• Alpine v3.24.0
• Ubuntu v26.04
• .NET v10
• PipEnv v2026.6.2
• libicu v78
• Node.js v22.22.1
• Python v3.14.4

GitHub Workflow Integration (v2.1.1) also introduces a new uninstallation workflow. Administrators can now uninstall the Veracode app from GitHub organizations directly through the Veracode Platform — streamlining lifecycle management without toggling settings in GitHub itself.

GitLab gets the same scm-packaging-5.0.0 support, enhancing packaging capabilities in repo workflows and broadening the range of project types covered.

• Packaging details: GitHub Workflow packaging requirements

That's the full set of updates since August 5th. For a complete history of platform changes, visit the Veracode release notes.