Veracode Fix

Veracode Fix is an AI-assisted remediation solution that generates secure code patches for security findings across multiple finding types, including SAST and SCA. Developers can review the suggested patches and apply them to their application source without writing code.

Account requirements

To use Fix, you must have one of the following accounts:

• User account with the Submitter user role.
• API account with the Submitter API role.

Apply fixes in your preferred environment

You can invoke Fix from three different surfaces, depending on your workflow:

• Fix in IDE: work interactively within your editor as you develop. Supported in Eclipse, JetBrains, Visual Studio, and VS Code for Fix for SAST.
• Fix in CLI: use the Veracode CLI to generate and apply patches. Supports both Fix for SAST and Fix for SCA. Designed for developers working on a small set of findings interactively or for automated scripting and CI pipelines.
• Fix in SCM: a low-friction, end-to-end workflow that scans your repository, generates patches for vulnerabilities, and opens merge requests with the fixes ready to review. Currently available for Fix for SCA.

Understand how Fix executes

Veracode Fix runs in two different ways depending on the finding type and surface:

• Fix for SAST: fast, interactive execution optimized for a developer reviewing and applying fixes one at a time at their terminal. Runs in bounded CLI sessions with limited context per call.
• Fix for SCA: runs in a backend sandbox with full source access, designed for automated or unattended invocation in CI pipelines, scheduled jobs, or SCM workflows. Can process more fixes in a single pass because it isn't constrained by an interactive terminal session. This is why Fix for SCA requires --remote. The remote agent model is foundational to SCA's capability to handle transitive dependencies and breaking changes.

The distinction matters because it determines what you can fix and how quickly. Interactive sessions are immediate but limited in scope, while remote sessions run longer but process batches of findings comprehensively.

Select the right Fix interface for your workflow

Product	Fix in IDE	Fix in CLI	Fix in SCM
Fix for SAST	Supported	Supported	Not available
Fix for SCA	Not available	Supported	Supported

note

Fix for SCA always initiates a remote session.