Data from integration saved in HackEDU

We make requests to the Veracode API at https://api.veracode.com/appsec, using the API key ID and secret value that you provide. All requests are signed using the veracode_api_signing Python package, as described here.

There are a total of two Veracode API endpoints that we use. First, we make requests to /vl/applications to get a list of applications associates with your Veracode account. When you choose to enable issue syncing for one of those applications, we store only the guid and profile.name values from that response:

{ 
   "guid": "84576933-126f-46e2-966d-e993f119a4e6",
   "profile": { 
       "name": "ExampleApplication1.0.5",
       "...": "(all other fields are ignored)" 
  },
  "...": "(all other fields are ignored)" 
}

When you've enabled issue syncing for an application, we'll sync issue data for that application nightly. As part of this process, we make requests to /v2/applications/:guid/findings, where guid is the aforementioned application ID, to retrieve a list of vulnerability findings from the Veracode API.

We store the data for each vulnerability that we find, but we first redact the description field, since it may contain arbitrary and potentially sensitive information:

{ 
   "build_id": 8495112, 
   "context_guid": "84576933-126f-46e2-966d-e993f119a4e6",
   "context_type": "APPLICATION", 
   "count": 1, 
   "description": "[REDACTED]", 
   "finding_details": { 
     "attack_vector": "Cross-Site Request Forgery (CSRF)", 
     "cwe": { 
       "href": "https://api.veracode.com/appsec/v1/cwes/352", 
       "id": 352, 
       "name": "Cross-Site Request Forgery (CSRF)" 
      }, 
      "discovered_by_vsa": 0, 
      "finding_category": { 
        "href": "https://api.veracode.com/appsec/v1/categories/11", 
        "id": 11, 
        "name": "Authentication Issues" 
      }, 
      "hostname": "subdomain.example.com", 
      "path": "/somepath/", 
      "plugin": "Authentication Issues", 
      "port": "8080", 
      "severity": 3, 
      "url": "http://subdomain.example.com:8080/somepath/",
      "vulnerable_parameter": "JSESSIONID" 
    }, 
    "finding_status": { 
      "first_found_date": "2020-09-13T20:56:17.380Z", 
      "last_seen_date": "2020-09-13T21:00:17.769Z",
      "mitigation_review_status": "NONE", 
      "new": true, 
      "resolution": "UNRESOLVED", 
      "resolution_status": "NONE", 
      "status": "OPEN" 
    },
    "issue_id": 7, 
    "scan_type": "DYNAMIC", 
    "violates_policy": false 
}

If you have any other questions, feel free to send us a message by emailing support@hackedu.com