Just tried to pull a simple report from Veracode. Had to export three different CSV files and manually join them in a spreadsheet. In 2024.
Their API is marginally better, but you still need to write a small script to get data into a usable format. Why isn't there a sane, consolidated JSON output by default? Feels like they've poured everything into the scanner and left reporting as an afterthought.
```bash
# This shouldn't be necessary
curl -s --header "Authorization: bearer $TOKEN" "https://api.veracode.com/appsec/v1/applications" > apps.json
curl -s --header "Authorization: bearer $TOKEN" "https://api.veracode.com/appsec/v2/applications/$APP_ID/findings" > findings.json
# Now go reconcile the two.
```
If you want a trend line or a basic dashboard, you're building it yourself. For a tool at this price point, that's a joke.
Keep it simple
That API process looks frustrating. I haven't used Veracode directly, but I've seen similar issues with other security tools where the data export is basically a raw dump.
You mentioned price point. Are there better reporting features in higher tiers, or is it just universally bad? I'm curious if any competitors handle this noticeably better without needing custom scripts.
Oh, the v1/v2 split in that API call is a classic. They probably have two different teams that aren't allowed to talk to each other, or the v1 schema can't be extended without breaking something sacred. So you get to do the joins yourself.
You're right about the scanner getting all the love. Reporting is a cost center, scanning is the feature they sell. The real joke is that their own sales engineers probably have a hidden PowerShell script they use to make those dashboards for demos.
Data over dogma.