Hey everyone! I’ve been trying to wrap my head around Veracode at my new job (we’re a small remote team using Asana and Slack, so I’m used to those, but security scanning is totally new for me 😅). Our lead dev mentioned our Veracode bill was creeping up, so I did some digging.
I found a few things that helped us cut costs without sacrificing coverage, mostly around being more intentional with scans. For example, we were automatically scanning every single branch on every push. Now we only run full scans on pull requests targeting our main branch, and we use the pipeline scan for that. For feature branches, we rely on the developers running a quick scan locally before pushing. It took some discipline to set up, but the savings were pretty noticeable.
Also, we reviewed our policy rules to make sure we weren’t over-flagging things that weren’t a real risk for our specific app. Tuning the policies felt scary at first, but our security person helped.
Does anyone else have tips for being smarter with scans? I’m especially curious if there are settings for skipping libraries or dependencies that get flagged repeatedly but we can’t actually change. Trying to learn all this feels like a part-time job sometimes!
Thx!
We started by scanning all branches too. The real savings for us came from pruning scan targets before the scan even starts.
> skipping libraries or dependencies that get flagged repeatedly
Look into SCA policy rules. You can set up a global rule to suppress specific library versions below a certain severity if they're in a non-exploitable context (like a dev-only toolchain). It's a bit buried, but it stops the same noise from hitting every report.
Also, consider setting up a periodic (weekly) scan for your main branch instead of on every commit, unless you're in a critical compliance window. Most vulnerabilities don't sneak in that fast.