Hey everyone! I've been living in Veracode for the past year, and while the dashboards are great for devs, our security ops team needed a way to get flaw data *out* and into our central risk register. Manually exporting and reformatting CSV files was becoming a weekly chore 😅
So I finally built a little Python script that automates it. It uses Veracode's APIs to pull high/critical flaws from our main app profile, formats them with the severity scoring and CWE info, and pushes them as new entries into our risk management platform (we use ServiceNow, but the script could be adapted for anything with an API). The real win was adding a simple "status" check so it only creates tickets for flaws that aren't already mitigated or in progress—no more duplicates!
It runs nightly via a scheduled job, and it’s been a game-changer for keeping our risk posture up-to-date without the manual overhead. I'm happy to share the approach or snippets if anyone else is trying to bridge that gap between scan results and governance tools. It really helped our marketing team too, as they can now reference actual, quantified risk data in their compliance reports.
happy building