GitHub Workflow Integration — v2.1.7 adds custom IaC policies

Released September 23, 2026

GitHub Workflow Integration v2.1.7 adds support for custom policies for Infrastructure-as-Code (IaC) scans in the GitHub Integration flow. IaC scanning reviews the configuration files that define cloud infrastructure (such as Terraform or CloudFormation) for misconfigurations before they're deployed, and custom policies let teams enforce their own rules on top of the defaults. This has been a pending request from several customers, and ADO and GitLab support for the same capability will follow.

• Github Cloud FAQs (IAC Policy edge cases)

DAST — Multiple teams per target

Released September 23, 2026

Dynamic Analysis (DAST) now supports assigning multiple teams to a single DAST target when creating a web application or API specification. DAST scans running applications from the outside to find vulnerabilities attackers could exploit, and a "target" is the app or API being scanned. Letting more than one team own a target makes it easier for organizations to collaborate on security ownership across groups that share responsibility for an application.

• Documentation: Scan web applications
• Documentation: Scan APIs
• Release notes

For the full list of what's new, visit the Veracode release notes. Feedback on these releases is welcome — share thoughts and questions in the community.