Hi @AKulkarni119679 (Community Member)​ - You're always welcome to reach out by creating a Case and our team can assist you there: https://community.veracode.com/s/contact-support

In the meantime, here are a few things worth checking — one of them solves this most of the time.

First, the big one: "veracode static scan" runs a Pipeline Scan, not Upload and Scan.

Those are two different scan types with different results, and Pipeline Scan is not connected to the Veracode Platform. It will not show up in your application profile, it will not evaluate against your policy, and it does not do flaw matching or respect mitigations you have already approved. So if you are comparing CLI output against a policy scan in the Platform and the numbers do not line up, that is expected behavior rather than a bug.

If you want the scan that appears in your application profile and counts for policy, that is Upload and Scan, which you run from the command line with the Java API Wrapper: https://docs.veracode.com/r/c_about_wrappers

If Pipeline Scan is what you want, here is the flow worth sanity-checking:

1. Credentials. Run "veracode configure", or set VERACODE_API_KEY_ID and VERACODE_API_KEY_SECRET if you are in CI.

2. Package first, scan second. The scan command takes a packaged artifact, not a source directory:

veracode package --source ./my-app --output ./verascan --trust

veracode static scan ./verascan/my-app.zip

The --trust flag is required the first time. Add --verbose to the package step and actually read what it produced — if the packager quietly skipped a module, your scan is covering less than you think.

3. Confirm you are giving it something scannable. Veracode SAST analyzes compiled artifacts, not raw source. For C/C++ and Apple platforms, debug symbols (or PDBs on Windows) are required if you want accurate file and line numbers. Missing debug symbols is a very common reason results look wrong — the flaws are real, the locations just are not mapped.

4. Check your own flags. --include limits which top-level modules get scanned, --baseline-file suppresses anything already in the baseline, and --fail-on-severity / --fail-on-cwe filter what gets reported. Any of those will make a scan look thinner than it is.

Docs worth bookmarking:

veracode package: https://docs.veracode.com/r/veracode_package

veracode static scan: https://docs.veracode.com/r/veracode_static_scan

Packaging requirements: https://docs.veracode.com/r/compilation_packaging

Pipeline Scan: https://docs.veracode.com/r/Pipeline_Scan