Use Veracode Fix in your development workflows
Veracode Fix integrates directly into your development environment, enabling you to remediate security findings where you work. Choose the integration method that best suits your workflow:
Use Veracode Fix in CLI
Use the Veracode CLI to generate and apply fixes directly from your terminal. Choose between interactive fixing for SAST findings or automated batch processing for SCA findings.
Resolve SAST findings
Use Fix for SAST for interactive terminal use. Review and apply patches one at a time at your own pace after you run a Pipeline Scan. For complete documentation on all available arguments and flags, see veracode fix.
After you run the scan, a Fix report is generated that documents all changes and skipped items.
Resolve SCA findings
Use Fix for SCA for automated workflows such as CI pipelines, scheduled jobs, and unattended batch processing. It runs fixes server-side in a sandboxed backend so you can process multiple findings in a single session and handle complex scenarios like breaking changes across dependencies. For complete documentation on all available arguments and flags, see veracode fix sca.
After you run Fix for SCA, a Fix report is generated that documents all changes and skipped items.
Command reference
The following table shows the available commands for each Fix product and their supported flags:
| Product | Command | Without --remote | With --remote |
|---|---|---|---|
| Fix for SAST | veracode fix | Supported | Not available |
| Fix for SCA | veracode fix sca <source> | Not available | Supported |
The --remote flag is required for Fix for SCA and is not available for SAST fixes. It enables server-side processing for SCA, which supports batch operations and handling of complex dependency changes.
Use Veracode Fix in IDE
You can resolve SAST findings directly in your IDE using AI-assisted remediation. Install the Veracode IDE plugin for your development environment and use Fix for SAST to generate and apply patches as you review scan results.
For the list of supported IDEs and installation instructions, see Supported IDEs. Fix for SAST provides AI-powered code analysis and patch generation for SAST findings. For details about coverage, supported languages, and capabilities, see Fix for SAST.
Use Veracode Fix in SCM
Use Veracode Fix to automate remediation of SCA findings through your source code management system. When you run a scan, Veracode Fix generates security patches for vulnerable dependencies and opens pull or merge requests with fixes ready for review.
- Fix in SCM is supported for Fix for SCA only.
- Fix in SCM is available for GitHub Enterprise Cloud only.
Benefits
You can use Veracode Fix in SCM to:
- Deploy security fixes with minimal effort. After installing the SCM Workflow App or integration, turn on Fix with a single configuration change. No extra tools or per-developer setup required.
- Automate the complete fix workflow from scan to merge. Developers select vulnerabilities to fix while Fix generates patches and creates pull or merge requests automatically.
- Integrate fixes seamlessly into code review. Fixes arrive as standard pull or merge requests in your existing workflow, and developers can review them without interruption.
How Fix in SCM works
When you use Veracode Fix in SCM, the following happens:
- The SCM Workflow integration triggers a scan.
- Findings appear in a comment on the pull or merge request.
- A developer replies with a comment to select which findings to resolve. To fix all SCA findings, reply with
@veracode-fix SCA-*. A remote session then starts in a Veracode-hosted sandbox. - A new pull or merge request opens with remediation.
A Fix report is generated that documents all changes and skipped items.
Set up Fix for SCA
For GitHub Workflow Integration setup instructions, see Generate fixes for SCA findings.