TIL: You can suppress findings by file path regex via the API

While reviewing our Veracode pipeline integration for a large monorepo, I identified a recurring inefficiency: the platform was flagging vulnerabilities in auto-generated SDK clients and protobuf stubs. These are third-party generated files checked into the repository for build reproducibility, and their findings are non-actionable noise for our team. Manually suppressing these through the web interface for each new scan was untenable.

I discovered that Veracode's `Results` API provides a programmatic method to suppress findings based on a regular expression applied to the file path. This is far more scalable than per-finding suppression. The endpoint is `PUT /api/findings/suppress` and it accepts a JSON payload specifying the application GUID, scan type, and the regex pattern.

Here is a concrete example of the API call we've integrated into our post-scan processing pipeline:

```bash
curl -X PUT 'https://api.veracode.com/appsec/v1/applications/{app_guid}/findings/suppress'
-H 'Authorization: Bearer {your_token}'
-H 'Content-Type: application/json'
-d '{
"scan_type": "STATIC",
"suppression_type": "FILE_PATH",
"suppression_value": ".*/generated-sources/.*\.java$"
}'
```

Key implementation details and benchmarks:
* **Performance Impact**: Suppressing ~1200 recurring findings across 15 microservices reduced our average triage time per scan by 65%, from 45 minutes to under 16 minutes.
* **Regex Specificity**: The pattern must be carefully constructed. We initially used `.*generated.*` which inadvertently matched legitimate source files in directories named `generated-services`. A more precise pattern like `.*/target/generated-sources/.*` proved necessary.
* **API Limitations**: The suppression is application-wide and persistent across scans, which is the intended behavior. However, it requires `WRITE` level permissions on the API token. Changes are not instantaneous and may take a few minutes to reflect in the portal.

This method is superior to the manual GUI approach for managing technical debt in large, complex codebases. It allows us to maintain a clean, actionable findings list focused on human-written code, thereby improving the signal-to-noise ratio for our security engineers. Consider integrating such a call into your CI/CD orchestration if you have similar classes of false positives.

—chris