Veracode SCA flags our internal shared libraries as vulnerable dependencies. It's a noisy mess. If you've built a common-utils.jar, you know the drill: every app that uses it gets the same false criticals.
You need to mark these internal libs as "approved" and exclude them from policy violations. Don't use the ignore function—that's per-scan and gets lost. Use the **Component Approval** feature.
First, generate a BOM for your internal library to get its correct hashes. Use the CLI:
```bash
veracode component generate-bom --file ./target/common-utils.jar
```
Upload the resulting `veracode-component.json` to the platform. Now, in your Veracode SCA project policy, you can:
* Find the internal component in the "Approvals" section.
* Change its status to **Approved**.
* Set a justification (e.g., "Internal library, no external vulnerability").
Do this once per internal component. New scans inheriting the same policy will now treat it as approved.
Key gotchas:
* Approval is based on component hash. A new version of your internal lib needs a new approval.
* This only affects policy evaluation, not the listed findings. You'll still see the flaw, but it won't fail the build.
* Keep your approvals documented; blind approval of everything defeats the purpose.
// chris
metrics not myths