Your Python applications must meet specific compilation requirements before you can submit them for scanning.
See Supported languages and platforms for instructions for other platforms.
You can analyze applications using Veracode Static Analysis or Veracode Software Composition Analysis (SCA) upload and scan, if licensed. For SCA agent-based scan requirements, see Using Veracode SCA with Programming Languages.
Python automated packaging
The Veracode CLI
package command simplifies the packaging process for Python projects. See Veracode CLI for instructions.
Veracode requires all source files for the application, including HTML template files, such as Flask/Django.
Veracode can also analyze Jython applications that you submit as source.
Supported Python versions
Supported Python frameworks and libraries
|AWS SDK for Python (Boto3)
|1.x, 3.x, 4.x
|0.9.2 and earlier
|Jinja Template Library
Upload a compressed ZIP archive containing all Python and HTML code, maintaining the project structure, to Veracode. Do not include third-party packages. Do not upload individual Python source files. If using Veracode Software Composition Analysis, include
Pipfile.lock in the root of your ZIP archive.
Veracode scans only files with these extensions:
Packaging AWS Lambda applications
Veracode requires you to submit applications built for AWS Lambda according to the AWS Lambda Deployment Package formats. For information, see https://docs.aws.amazon.com/ and search for AWS Lambda Deployment Package in Python.
Veracode does not support the analysis of dependencies submitted as Lambda layers. To analyze Lambda components deployed in layers, submit them as standard deployment packages, or consider repackaging the function to include layer components as part of the lambda function package.
Identifying Lambda function handlers for Python
In Python, function handlers must have at least two positional (default) parameters. The function handlers may have additional parameters that must have initial values set because AWS Lambda passes data only to the first two positional parameters.
To detect Lambda function handlers for Python, Veracode accepts the YAML and YML configuration files included as part of the uploaded package from the Serverless and AWS SAM frameworks. Veracode parses these configuration files to identify the function handlers defined in the uploaded artifact. Veracode uses these configuration files to identify the configuration of layers or other settings.
When a deployment package does not contain a YAML configuration file, Veracode applies this heuristic to identify the candidate source files in which to look for function handlers in the deployment package:
If a directory called
functionsexists, Veracode recognizes every Python file in every subdirectory below
functionsas a candidate source file. Veracode does not consider files in any directories one level below
functionsas candidate files.
For example, in the following directory structure, the candidate files are:
│ ├── misc
│ │ └── utils.py
│ └── primero.py
Every Python file in the top-level directory of the archive is a candidate source file.
For example, in the following directory structure, the only candidate file is
│ └── utils.py
After Veracode identifies a candidate file, functions with exactly two parameters or with more parameters where all additional parameters have initial values set are considered function handlers. Example candidate function handlers are:
def lambda_handler(event, context):
def different_func(evt, ctx, xyz=123):
This function cannot be a function handler: