GitHub Workflow Integration — v2.1.7 adds custom IaC policies

Released September 23, 2026

GitHub Workflow Integration v2.1.7 adds support for custom policies for Infrastructure-as-Code (IaC) scans in the GitHub Integration flow. IaC scanning reviews the configuration files that define cloud infrastructure (such as Terraform or CloudFormation) for misconfigurations before they're deployed, and custom policies let teams enforce their own rules on top of the defaults. This has been a pending request from several customers, and ADO and GitLab support for the same capability will follow.

• Github Cloud FAQs (IAC Policy edge cases)

DAST — Multiple teams per target

Released September 23, 2026

Dynamic Analysis (DAST) now supports assigning multiple teams to a single DAST target when creating a web application or API specification. DAST scans running applications from the outside to find vulnerabilities attackers could exploit, and a "target" is the app or API being scanned. Letting more than one team own a target makes it easier for organizations to collaborate on security ownership across groups that share responsibility for an application.

• Documentation: Scan web applications
• Documentation: Scan APIs
• Release notes

For the full list of what's new, visit the Veracode release notes. Feedback on these releases is welcome — share thoughts and questions in the community.

The fix for the VeracodeFlawImporter task space migration is development-complete. It ships in our major release on 30 September 2026.

What's changing

This release removes the previously deprecated tasks.

What you need to do

• If you plan to upgrade to the 30 September release: Migrate to the new tasks before you upgrade. The deprecated tasks won't be available after the upgrade, so migrating early keeps your pipelines running.
• If you stay on an earlier version: You can keep using the existing (legacy) tasks.

More information

https://docs.veracode.com/r/Azure_DevOps_Extension

Released September 21, 2026

The first production release of EASM's completely rebuilt webapp is now live, introducing a modern, modular, and tailored customer experience. The new webapp becomes the official production UI, with refreshed navigation and a consistent experience across the platform that adapts to project type and enabled capabilities.

EASM (External Attack Surface Management) continuously discovers and monitors internet-facing assets so teams can see their exposure before attackers do. This release establishes a clear transition path away from the Legacy interface, which moves to bug-fix-only maintenance, while the new Standard experience becomes the official webapp.

On first sign-in, users can choose their environment — Legacy or Standard — and that selection is remembered for future sign-ins. Legacy can be re-selected at any time, giving teams flexibility during the transition.

• EASM docs
• Release notes

For the full list of what's shipped across Veracode, visit the Veracode release notes. 

Veracode Analytics introduces the IDE and CLI Usage Explore and Dashboard to visualize and explore your organization's IDE and CLI usage. For more information, see Pre-built Analytics Dashboards and IDE and CLI Usage explore data dictionary.

Note that events from the following IDE plugin versions display null error codes and messages:

• VS Code v1.16.2 and earlier
• Visual Studio v0.8.1 and earlier
• JetBrains v1.8.0 and earlier

To stay up to date when error codes and error messages become available in Analytics, follow Integration updates.

Next week's September Static Analysis Release includes the following:

Updated language and framework support

.NET

• Improved CWE-259 and 798 flaw detection, resulting in a reduction in false positives.

Android

• Enhanced support for Android 16.

Apple Platforms

• Adds support for iOS 27.

Go

• Adds support for Go 1.27.

PL/SQL

• Improves parsing of PL/SQL code and scan performance.

Python

• Improved detection of CWE-89 vulnerabilities in PySpark applications.
• Improved SQLAlchemy analysis to reduce false positives when detecting CWE-89 vulnerabilities.
• Improves detection of third-party code.

RPG

• Improved detection of CWE-200 flaws to reduce false positives.
• Improved analysis of CALL commands to enhance detection of CWE-252 flaws.

Other languages

• Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.

Veracode's GitHub Workflow Integration just got a major upgrade with version 2.0.0!

Did you know that you can now set up the entire Veracode GitHub Integration directly from the Veracode platform — no more GitHub Marketplace installations, and no more manual steps like importing repositories?

That's just the beginning. Here's what else is new:

🔧 Manage credentials in-platform — Update your Veracode integration credentials without ever leaving the platform.

🗓️ Scheduled scans for Static, SCA, and IaC — Set up scans to trigger on your preferred schedule across installed organizations (just like you can with ADO). This extends the value of repository scanning and gives AppSec teams a structured, scheduled security posture — including improved visibility into dormant repos with little or no development activity.

🔄 Already installed via GitHub Marketplace? No problem. You can start using the platform to install Veracode on other organizations, update credentials, and schedule scans. The Marketplace installation path isn't going away — it continues to work as-is.

🆕 New language support — Apex, VB6, and Perl are now supported.

This release is all about our Zero Drift vision — eliminating the manual steps and onboarding friction that customers experienced with the original GitHub Workflow Integration. 

Want to learn more or get started? Let's talk! 🚀

Next week's August Static Analysis Release includes the following:

Updated language and framework support

Android

• Enhanced support for Android 16.
• Improved third-party detection.

Dart and Flutter

• Adds support for hardcoded value detection in get assignments modeled as getter functions.

Java

• Improves Java scan performance when analyzing common template patterns.
• Improved detection of CWE-78 flaws.

JavaScript

• Adds support for Next.js 16.x

PHP

• Enhanced detection of third-party code.

PL/SQL

• Improved scan performance.

Python

• Improves detection of hardcoded passwords and credentials (CWE-259 and CWE-798).
• Adds support for the Python google-cloud-bigquery library.

RPG

• Improves remediation guidance for flaws associated with CWE-78, CWE-114, CWE-200, CWE-338, CWE-359, CWE-628, CWE-787, and CWE-823.
• Improved detection of CWE-787 flaws to reduce false positives.
• Improved RPG parsing.

Other languages

• Improves detection of CWE-259 and CWE-798 flaws across all languages to reduce false positives.