<?xml version="1.0" encoding="UTF-8"?>        <rss version="2.0"
             xmlns:atom="http://www.w3.org/2005/Atom"
             xmlns:dc="http://purl.org/dc/elements/1.1/"
             xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
             xmlns:admin="http://webns.net/mvcb/"
             xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
             xmlns:content="http://purl.org/rss/1.0/modules/content/">
        <channel>
            <title>
									Veracode Reviews - Welcome to Stackinsight community. Join the discussion about products and tools for work Forum				            </title>
            <link>https://communities.stackinsight.net/community/cyber-veracode/</link>
            <description>Welcome to Stackinsight community. Join the discussion about products and tools for work Discussion Board</description>
            <language>en-US</language>
            <lastBuildDate>Sun, 15 Nov 2026 08:52:36 +0000</lastBuildDate>
            <generator>wpForo</generator>
            <ttl>60</ttl>
							                    <item>
                        <title>What to use instead of Veracode for SAST? Alternatives that actually work</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/what-to-use-instead-of-veracode-for-sast-alternatives-that-actually-work-2/</link>
                        <pubDate>Mon, 28 Sep 2026 08:31:17 +0000</pubDate>
                        <description><![CDATA[Alright, listen up. I’ve seen Veracode come and go on a few procurement cycles. It’s the usual story: big sales team, enterprise contracts that lock you in, a dashboard that makes middle man...]]></description>
                        <content:encoded><![CDATA[Alright, listen up. I’ve seen Veracode come and go on a few procurement cycles. It’s the usual story: big sales team, enterprise contracts that lock you in, a dashboard that makes middle management feel safe, and a scan queue that makes your CI/CD pipeline feel like it’s running on molasses in January. For a lot of teams, especially if you’re not drowning in budget or you actually want to fix issues, not just report them, you need alternatives that integrate and give actionable results fast.

I’m going to talk about what we actually run in production and what has stuck around after the hype died down. The goal is to get SAST into the developer’s workflow *before* the commit or at least before the merge request is approved. If your security tool isn’t talking to your code host or CI system, it’s a fancy report generator, not a preventative control.

Here’s the stack that’s proven itself, warts and all:

*   **Semgrep:** This is my top recommendation for most teams. It’s the closest thing to "it just works" without being stupid. You can start with their curated rules (which are good), but the real power is writing your own rules in a way that doesn’t require a PhD in abstract syntax trees. It runs in seconds, not hours. Integration is a `semgrep ci` command in your pipeline.
    ```bash
    # Example: Run in CI with only blocking findings on high-confidence issues
    semgrep ci --config auto --severity ERROR --baseline-commit HEAD~1
    ```
    Pitfall: You *must* tune it. Out of the box, it’ll have some noise. Spend an afternoon refining rules for your framework.

*   **SonarQube (or the cloud-hosted SonarCloud):** Don’t roll your eyes. It’s been around forever because it works. It’s more than just SAST—code smells, bugs, security—all in one. The quality gates are a solid way to enforce a standard. The self-hosted option is a beast to maintain, so start with SonarCloud if you can. It plays nice with PR decorations.

*   **Checkmarx:** If you’re in a larger enterprise and absolutely need something with a name that makes the CISO nod, Checkmarx is the usual alternative to Veracode. It’s still a heavyweight scanner, but in my experience, its incremental scanning and pipeline integration are less painful than Veracode’s. The licensing will still give you sticker shock.

*   **Trivy for IaC and Secrets:** While we’re talking about shifting left, Veracode’s secret scanning is an afterthought. Run **Trivy** in your pipeline. It’s free, fast, and catches those hardcoded AWS keys in config files that Veracode might miss until it’s too late.
    ```yaml
    # A trivial GitHub Actions step
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        scan-ref: '.'
        format: 'sarif'
        output: 'trivy-results.sarif'
    ```

The bottom line is this: the best SAST tool is the one your developers don’t actively avoid. It needs to be fast, relevant, and integrated into their existing tools (GitHub, GitLab, Azure DevOps). If it takes longer than their test suite to run, they’ll skip it. If it produces a 500-page PDF, nobody will read it. Start with Semgrep or SonarCloud, get it failing the build on critical issues only, and go from there.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>devops_grandad</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/what-to-use-instead-of-veracode-for-sast-alternatives-that-actually-work-2/</guid>
                    </item>
				                    <item>
                        <title>Anyone actually using Veracode&#039;s pipeline scanner in CI/CD for a K8s deployment?</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/anyone-actually-using-veracodes-pipeline-scanner-in-ci-cd-for-a-k8s-deployment-2/</link>
                        <pubDate>Mon, 28 Sep 2026 06:11:23 +0000</pubDate>
                        <description><![CDATA[Hey everyone! Been lurking here for a bit, mostly in the data pipeline channels, but my team&#039;s been diving deeper into security lately. We&#039;re a heavy K8s shop, and we&#039;ve been evaluating Vera...]]></description>
                        <content:encoded><![CDATA[Hey everyone! Been lurking here for a bit, mostly in the data pipeline channels, but my team's been diving deeper into security lately. We're a heavy K8s shop, and we've been evaluating Veracode's pipeline scanner for our CI/CD. The promise of shifting security left without grinding deployments to a halt is super appealing.

I'm curious about real-world experiences, though. Anyone running this in a Kubernetes deployment pipeline? Specifically, I'm trying to picture the integration points. Do you run the scanner as a sidecar in your build pods, or as a separate step in your Jenkins/GitLab/Actions pipeline that feeds the results back? How's the feedback loop for developers? We're worried about adding minutes to our PR builds.

Here's a super simplified snippet of how we were thinking of structuring it in a GitHub Action for a Go service:

```yaml
- name: Veracode Pipeline Scan
  uses: veracode/veracode-pipeline-scan-action@v1
  with:
    vid: ${{ secrets.VERACODE_API_ID }}
    vkey: ${{ secrets.VERACODE_API_KEY }}
    file: "./deployment-artifacts/"
    args: "--fail_on_severity=VeryHigh,High"
```

But that's just the "does it run?" part. The real magic (or pain) is in the details for K8s. Are you scanning the built container image itself, the Helm charts, the K8s manifests, or all of the above? How do you handle the findings—do they block the image push to the registry, or is it more of a report?

Any gotchas around networking, permissions, or scanning speed on larger images would be super helpful to know before we commit.

ship it]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>data_shipper_joe</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/anyone-actually-using-veracodes-pipeline-scanner-in-ci-cd-for-a-k8s-deployment-2/</guid>
                    </item>
				                    <item>
                        <title>Is Veracode worth the price for a 10-person team? Actual cost breakdown</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/is-veracode-worth-the-price-for-a-10-person-team-actual-cost-breakdown/</link>
                        <pubDate>Sat, 26 Sep 2026 18:22:15 +0000</pubDate>
                        <description><![CDATA[Let&#039;s cut through the marketing. For a 10-person engineering team, Veracode&#039;s pricing is rarely straightforward and often hard to justify unless you&#039;re in a heavily regulated industry or hav...]]></description>
                        <content:encoded><![CDATA[Let's cut through the marketing. For a 10-person engineering team, Veracode's pricing is rarely straightforward and often hard to justify unless you're in a heavily regulated industry or have specific compliance mandates. The sales model is enterprise-first, which means small teams get a bad unit cost and are forced into bundles they don't need.

Here's a breakdown of what you're actually looking at, based on recent quotes I've seen and discussions with other leads:

*   **Base Platform Cost:** You don't buy individual tools. You buy the "Veracode Platform," which bundles Static Analysis (SAST), Software Composition Analysis (SCA), and Dynamic Analysis (DAST). For 10 seats, you're likely looking at a starting point of **$45,000 - $65,000 USD annually**. This is the biggest hurdle.
*   **Scan Volume:** That base price usually includes a limited number of scans. Exceed it, and you're into overage fees. With modern CI/CD pipelines, hitting limits is easy.
*   **Add-on Costs:** Want container scanning? That's extra. Want API scanning? That's extra. Their "Greenlight" IDE plugin? Might be included, might not.
*   **Professional Services:** Their out-of-the-box setup is mediocre for complex pipelines. Expect to budget for some professional services to get it integrated properly, especially if you have a monorepo or non-standard build process. That's another $10k-$20k upfront.

The technical experience is a mixed bag. The SAST engine (based on older acquisitions) can be noisy and slow. Tuning it to reduce false positives requires significant upfront investment. Their SCA is decent, but you're locked into their vulnerability database. The API is serviceable for basic automation, but I've had to write more glue code than I'd like.

```yaml
# Example of a simple pipeline integration snippet (simplified)
- name: Veracode SAST Scan
  uses: veracode/veracode-scan-action@v1
  with:
    vid: ${{ secrets.VERACODE_API_ID }}
    vkey: ${{ secrets.VERACODE_API_KEY }}
    # Critical: You'll spend time here defining what to exclude
    file_pattern: "**/*.jar"
    exclude_pattern: "**/test/**/*.jar,**/node_modules/**"
    # Scan time scales with codebase size, can bottleneck deployment
```

**Alternatives you must evaluate:** For a team of 10, you could assemble a best-of-breed stack for a fraction of the cost.
*   **SAST:** SonarQube (self-hosted or Cloud), Semgrep, or CodeQL (if you're already on GitHub Advanced Security).
*   **SCA:** Dependabot (GitHub) or Renovate (free/open source) combined with Trivy or Grype for container/OS scanning.
*   **DAST:** OWASP ZAP (open source) or a niche commercial tool if you really need it.

**Bottom line:** Veracode is worth the price only if your primary need is audit compliance (SOC2, FedRAMP, etc.) and generating the required reports to satisfy external auditors, not if your primary goal is developer-centric security feedback and speed. For a nimble 10-person team focused on engineering efficiency, the cost and friction are difficult to swallow. You're paying for the suite, the brand, and the sales team, not for superior tooling.

—davidr]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>David R.</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/is-veracode-worth-the-price-for-a-10-person-team-actual-cost-breakdown/</guid>
                    </item>
				                    <item>
                        <title>Reaction: Their new &#039;risk score&#039; seems like a black box. How is it calculated?</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/reaction-their-new-risk-score-seems-like-a-black-box-how-is-it-calculated-2/</link>
                        <pubDate>Sat, 26 Sep 2026 04:16:16 +0000</pubDate>
                        <description><![CDATA[Just saw the dashboard update. The new &quot;risk score&quot; front and center is giving me AWS Cost Explorer vibes, but at least there I can drill down into line items. This feels opaque.

I get the ...]]></description>
                        <content:encoded><![CDATA[Just saw the dashboard update. The new "risk score" front and center is giving me AWS Cost Explorer vibes, but at least there I can drill down into line items. This feels opaque.

I get the need for a single metric, but if I'm going to prioritize fixes for my team, I need to know what's driving it. Is it 90% because of one critical flaw? Or 50% because we have a ton of low-severity findings? The documentation mentions "exploitability, prevalence, and age" but doesn't show the math.

Has anyone gotten a clear answer on the actual calculation? Or found a way to reverse-engineer it from the findings list? My main concerns:
* Can a minor finding in a rarely-used endpoint tank the score as much as a major flaw in a public API?
* How does the "age" weighting work? Is it linear or does it ramp up after a specific SLA window?
* Does it factor in context, like if a finding is in a container vs. a lambda function (where the exposure might be different)?

Without transparency, it's hard to trust it for anything more than a high-level trend line. I'd rather build my own risk metric from the raw findings data if this is just a proprietary magic number.

cb]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>chrisb</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/reaction-their-new-risk-score-seems-like-a-black-box-how-is-it-calculated-2/</guid>
                    </item>
				                    <item>
                        <title>What does Veracode actually cost after the sign up?</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/what-does-veracode-actually-cost-after-the-sign-up-2/</link>
                        <pubDate>Fri, 25 Sep 2026 05:41:11 +0000</pubDate>
                        <description><![CDATA[The advertised &quot;contact sales&quot; pricing is the first red flag. You&#039;re not buying a toaster. The initial quote they give you is for the bare bones, air-gapped, &quot;we only scan on Tuesdays&quot; packa...]]></description>
                        <content:encoded><![CDATA[The advertised "contact sales" pricing is the first red flag. You're not buying a toaster. The initial quote they give you is for the bare bones, air-gapped, "we only scan on Tuesdays" package. Then reality hits.

The real cost comes from the integrations they don't tell you about until your security team tries to enforce the policy. Want that fancy IDE plugin for your developers? That's another module. Want to actually block a build in your CI/CD pipeline instead of just generating a PDF nobody reads? That's a separate SKU, and it's priced per pipeline agent, not per scan. Suddenly your "per scan" cost has a multiplier attached to your entire deployment infrastructure.

And then there's the resource tax. Their SCA (software composition analysis) agent, by default, tries to download the entire universe on every run. I've seen build times balloon by 15 minutes because their scanner decides it needs a fresh copy of every library from the Stone Age. You end up paying for that in engineering time and cloud compute, which never shows up on Veracode's invoice. You'll spend a week tuning the `.veracode` config to stop it from analyzing `node_modules/leftpad` for the thousandth time.

```xml
<!-- A taste of the "optimization" ritual -->

    
    
    <!-- Add 50 more lines to stop it from scanning vendored binaries -->

```

The support tier you need to get anything fixed is the one above "Standard," which they casually mention after your first critical false positive sits in a queue for a week. The true total cost is the license fee, plus the FTE you'll need to dedicate to managing the platform, arguing with their support over misclassified vulnerabilities, and cleaning up the resource exhaustion incidents in your build farm. It's platform-as-a-service with a side of platform-engineering-for-you.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>devops_not_grunt</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/what-does-veracode-actually-cost-after-the-sign-up-2/</guid>
                    </item>
				                    <item>
                        <title>Dynamic scan keeps missing our auth endpoints. Configuration issue?</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/dynamic-scan-keeps-missing-our-auth-endpoints-configuration-issue-2/</link>
                        <pubDate>Sun, 23 Aug 2026 01:00:57 +0000</pubDate>
                        <description><![CDATA[Alright, let&#039;s talk about Veracode&#039;s dynamic scanning. I&#039;m convinced half of its &quot;findings&quot; are a coin toss, and the other half are things you already know. But the real gem is when it compl...]]></description>
                        <content:encoded><![CDATA[Alright, let's talk about Veracode's dynamic scanning. I'm convinced half of its "findings" are a coin toss, and the other half are things you already know. But the real gem is when it completely fails to see entire attack surfaces.

We've got a Flask app with a standard JWT auth flow. The dynamic scan, despite being fed what we *thought* were correct authentication scripts, sails right past our `/api/v1/admin/*` endpoints. It's as if they're not even there. The report comes back with a handful of low-severity issues on our public landing page, but the actual business logic—the stuff that handles privileged data—gets a free pass.

We followed the guide, used the "Record Login" function in the scanner, and it *seems* to capture the session. The config looks like this:

```xml

  
    navigate
    https://our-app.com/login
  
  
    set
    id=username
    ${USERNAME}
  
  
    set
    id=password
    ${PASSWORD}
  
  
    click
    id=submit
  
  
    waitFor
    id=user-profile
  

```

The scanner logs show a successful login. Yet, the subsequent crawl behaves like a logged-out user. It's not a subtle failure; it's a complete blind spot.

So, the million-dollar question: is this a fundamental limitation of their crawling engine when dealing with SPAs or APIs that don't serve full HTML pages for every state change? Or did we just fall into one of those configuration black holes where the documented approach works for a simple PHP form but falls apart with anything modern?

I've heard whispers that their dynamic scanner struggles with anything beyond basic form-based auth and session cookies. Any truth to that? If you've managed to get it to actually scan authenticated API endpoints, what was the magic incantation?]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>contrarian_coder</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/dynamic-scan-keeps-missing-our-auth-endpoints-configuration-issue-2/</guid>
                    </item>
				                    <item>
                        <title>Complete newbie here - where should I start with a policy setup?</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/complete-newbie-here-where-should-i-start-with-a-policy-setup/</link>
                        <pubDate>Sat, 22 Aug 2026 21:55:50 +0000</pubDate>
                        <description><![CDATA[You picked a fun one to start with. Policy setup in Veracode feels less like security engineering and more like navigating a vendor&#039;s pre-defined maze.

First, accept that their default poli...]]></description>
                        <content:encoded><![CDATA[You picked a fun one to start with. Policy setup in Veracode feels less like security engineering and more like navigating a vendor's pre-defined maze.

First, accept that their default policy is designed to fail a lot of scans. It's how they sell more consultant hours and "mitigation" services. Your real starting point is your own risk appetite, not their checkbox list.

Ignore the platform's suggestions at first. Go find your actual compliance requirements (SOC2, PCI-DSS, etc.) and map *those* to the policy rules. You'll spend more time fighting their obtuse UI than thinking about security. And for the love of privacy, don't just enable everything marked "critical" – you'll be buried in false positives from their mediocre static analysis.

—aB]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>Andrew Brown</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/complete-newbie-here-where-should-i-start-with-a-policy-setup/</guid>
                    </item>
				                    <item>
                        <title>First-time user - the training videos are too high-level. Any practical blogs?</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/first-time-user-the-training-videos-are-too-high-level-any-practical-blogs-2/</link>
                        <pubDate>Sat, 22 Aug 2026 07:55:50 +0000</pubDate>
                        <description><![CDATA[Hi everyone. I just started a trial with Veracode for a Python data pipeline project at work. I went through the onboarding training videos, but they felt very high-level and conceptual.

I’...]]></description>
                        <content:encoded><![CDATA[Hi everyone. I just started a trial with Veracode for a Python data pipeline project at work. I went through the onboarding training videos, but they felt very high-level and conceptual.

I’m trying to understand the practical steps. Like, where do I start with a simple Flask API or a set of data processing scripts? Are there any good blogs or hands-on tutorials that walk through actual setup, scanning, and interpreting results for a beginner? Something more concrete than the official overviews would be really helpful.]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>brian7</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/first-time-user-the-training-videos-are-too-high-level-any-practical-blogs-2/</guid>
                    </item>
				                    <item>
                        <title>Hot take: Their SCA is weak compared to dedicated tools</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/hot-take-their-sca-is-weak-compared-to-dedicated-tools-2/</link>
                        <pubDate>Fri, 21 Aug 2026 07:00:54 +0000</pubDate>
                        <description><![CDATA[Hey everyone, I&#039;ve been trying to learn application security as part of our DevOps pipeline and we&#039;re evaluating Veracode.

I keep hearing that their Static Analysis (SAST) is strong, but th...]]></description>
                        <content:encoded><![CDATA[Hey everyone, I've been trying to learn application security as part of our DevOps pipeline and we're evaluating Veracode.

I keep hearing that their Static Analysis (SAST) is strong, but their Software Composition Analysis (SCA) for open-source dependencies isn't as good. Coming from a beginner's perspective, can someone explain *why* that might be? Like, what makes a "dedicated" SCA tool (like Snyk or Mend) better in practice?

I ran a test on a simple Node.js project and the Veracode SCA scan in the pipeline seemed to miss some indirect dependencies that another tool flagged. Is that common?

```json
// Example package.json snippet
{
  "dependencies": {
    "express": "^4.18.2",
    "lodash": "^4.17.21"
  }
}
```

Really appreciate any insights from your experiences! Trying to understand the real-world differences, not just the marketing sheets &#x1f605;]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>devops_rookie_2025</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/hot-take-their-sca-is-weak-compared-to-dedicated-tools-2/</guid>
                    </item>
				                    <item>
                        <title>Fortify vs Veracode for a Fortune 500 financial services firm</title>
                        <link>https://communities.stackinsight.net/community/cyber-veracode/fortify-vs-veracode-for-a-fortune-500-financial-services-firm-2/</link>
                        <pubDate>Thu, 20 Aug 2026 22:56:00 +0000</pubDate>
                        <description><![CDATA[So we&#039;re doing the annual &quot;which SAST vendor will save us&quot; dance again, huh? The premise is always the same: a giant financial firm, a pile of legacy Java and .NET, and a boardroom suddenly ...]]></description>
                        <content:encoded><![CDATA[So we're doing the annual "which SAST vendor will save us" dance again, huh? The premise is always the same: a giant financial firm, a pile of legacy Java and .NET, and a boardroom suddenly worried about headlines after some breach. Now it's down to Fortify and Veracode.

Let's be clear: neither is a silver bullet. Anyone who tells you otherwise is selling something. Having audited outputs from both in a regulated environment, I can say they both excel at generating massive PDFs that make auditors nod. Where they differ is in the daily grind. Veracode's cloud-first model is great until your compliance team starts asking pointed questions about where the source code physically transits for that "policy scan." Fortify's on-prem heavyweight option gives you the illusion of control, but then you're babysitting servers and rule updates. Pick your poison.

For a financial firm, my cynical take is this: the decision is 80% about your procurement and compliance checklist, 20% about the tech. Does your vendor management policy tolerate a pure SaaS model? Does your GDPR/data sovereignty playbook allow for code to leave the EU? Veracode's pricing can get eye-watering at scale, but Fortify's initial capex and dedicated FTE to run it isn't cheap either. Both will flood you with false positives on your old COBOL services; both will miss the weird logic flaw in your new cloud microservice.

I'm more interested in how you plan to operationalize the findings. A tool that generates 10,000 criticals that get ignored is worse than one that finds 100 that get fixed. How's your pipeline integration? How does it tie into your JIRA and your blame-assignment... I mean, developer education workflows? The fanciest tool is just an expensive log generator if you haven't sorted that out.

—Greg]]></content:encoded>
						                            <category domain="https://communities.stackinsight.net/community/cyber-veracode/">Veracode Reviews</category>                        <dc:creator>gregm</dc:creator>
                        <guid isPermaLink="true">https://communities.stackinsight.net/community/cyber-veracode/fortify-vs-veracode-for-a-fortune-500-financial-services-firm-2/</guid>
                    </item>
							        </channel>
        </rss>
		