--- sourceDocument: Australia IT Service Management sourceDocumentLink: https://www.servicenow.com/docs/r/australia/it-service-management Release : - australia ft:locale : - en-US ft:publication_title : - Australia IT Service Management ft:clusterId : - itsm bundleId : - itsm workflow : - Technology --- # Veracode # Veracode integration with DevOps Change Velocity {#ariaid-title1} Release version: Australia Updated March 12, 2026 ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read Summarize ![AI sparkle icon](https://servicenow.com/docs/portal-asset/ai-sparkle-icon) Summarized using AI This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete. ## Summary of Veracode integration with DevOps Change Velocity This integration enables ServiceNow customers to connect their Veracode security scanning within CI/CD pipelines to DevOps Change Velocity. It retrieves security scan results from Veracode to help assess code vulnerabilities directly in the ServiceNow platform. Supported CI/CD tools include GitHub Actions, Jenkins, Azure DevOps, GitLab, and Harness pipelines. Show full answer Show less ## Key Features * **Supported Pipeline Integrations:** Veracode scans configured in GitHub Actions, Jenkins, Azure DevOps, GitLab, and Harness pipelines are supported. * **Pipeline Configuration Requirements:** * Azure DevOps and GitHub Actions require adding custom action code to pipelines. * Jenkins pipelines with existing Veracode scan steps only need `waitForScan: true` to enable scan result retrieval. * GitLab and Harness pipelines require use of a generic Docker container image to add Veracode scan steps. * **Scan Result Visibility:** Security scan results are accessible in the Change Request related list, pipeline Task Execution, and Pipeline UI within ServiceNow. * **Policy and Automation Use:** Retrieved security results can be utilized to define change policies and automate change processes based on vulnerability data. * **Required Roles and Plugins:** * Install the `DevOps Vulnerability Integrations (sndevopsvulints)` and `Vulnerability Response Integration with Veracode (snvulveracode)` plugins. * Relevant roles such as `snvul.appsecmanager` and `snvulveracode.configureintegration` are automatically assigned to the DevOps Tool Owner role upon plugin installation. ## Connecting and Onboarding Veracode Customers can onboard and connect their Veracode instance to DevOps Change Velocity using one of these methods: * **DevOps Change Workspace Playbook:** Provides a guided onboarding experience. * **ServiceNow Service Catalog:** Enables connection via a service catalog item. * **Classic Experience:** Allows manual connection and configuration. All methods enable retrieval and use of Veracode scan results within ServiceNow to enhance visibility and governance of application security within DevOps pipelines. Connect to your Veracode instance that is integrated with your CI/CD pipelines to retrieve security scan results. This helps you determine how vulnerable your code is. ## Veracode integration overview {#veracode-integration-with-devops-change-velocity__section_fzf_jqg_bqb} Veracode scans that are configured on GitHub Actions, Jenkins, Azure DevOps, GitLab, and Harness pipelines are supported in DevOps Change Velocity. Ensure that your Veracode credentials have the following API roles. * Upload and Scan * Results {#veracode-integration-with-devops-change-velocity__ul_rvz_v2l_cyb}For more information, see [Veracode documentation](https://docs.veracode.com/r/c_API_roles_details). You can configure Veracode scans on any stage of the pipeline and the scan details are retrieved from the corresponding stage to DevOps Change Velocity. If you're using Azure DevOps or GitHub Actions orchestration tools, then you must add the custom action code in your pipeline always. If you're using Jenkins, and your pipeline already has a Veracode security scan step, you don't have to add the custom action code in your pipeline. Ensure that your Veracode security scan step has waitForScan: true. This is required for the system to retrieve the scan information. If you want to configure Veracode for the GitLab tool, you can use the generic Docker container image to add the Veracode security step or perform the steps specified in the [Integrate security tools with GitLab](https://www.servicenow.com/docs/_Ei_m2ZDQ12JaIrx4Nm5eQ "Configure security tool for GitLab which is not supported in the base system.") topic. For Harness pipelines, you can configure Veracode scans only through the generic Docker Container Image. For more information, see [Implement custom actions for pipelines using Docker image](https://www.servicenow.com/docs/lyDd5Y1L9yyAuDzJFwe0tg "Use the ServiceNow custom actions to collect data related to change request creation, Sonar scan, artifact registration, and package registration in your pipeline with the help of the generic Docker Container Image."). You can view the security scan results in the related list of a Change Request, or the Task Execution of the pipeline, or in the Pipeline UI in your ServiceNow instance. You can also use security results in defining change policies and conditions for change automation. ## Get started {#veracode-integration-with-devops-change-velocity__section_fps_jhy_xxb} You must install the DevOps Vulnerability Integrations (sn_devops_vul_ints) and Vulnerability Response Integration with Veracode (sn_vul_veracode) plugins before connecting your Veracode instance to ServiceNow. For more information on activating a plugin, see [Install a ServiceNow Store application](https://www.servicenow.com/docs/access?context=t_InstallApplications&version=australia&pubname=australia-platform-administration&ft:locale=en-US). Note: * The sn_vul.app_sec_manager role is added to the DevOps Tool Owner \[sn_devops.tool_owner\] role when the DevOps Vulnerability Integrations plugin (sn_devops_vul_ints) is installed. * The sn_vul_veracode.configure_integration role is added to the DevOps Tool Owner \[sn_devops.tool_owner\] role when the Vulnerability Response Integration with Veracode plugin (sn_vul_veracode) is installed. {#veracode-integration-with-devops-change-velocity__ul_yn2_w2b_wfc} For more information on the scan results captured in ServiceNow, see [Security scan results](https://www.servicenow.com/docs/lFOZN4q9l4hz~6IV6W6Kfw "Security scan results display scan details from security scans configured on your GitHub Actions, Jenkins, Azure DevOps, GitLab, or Harness pipelines."). Use one of the following options to onboard Veracode. For a guided experience, use the workspace to onboard a tool. Alternatively, you can use the Service Catalog or Classic experience. * **[Onboard Veracode to DevOps Change Velocity - Workspace](https://www.servicenow.com/docs/ZclMBK4NH97O1~YvLNmsVg)** Connect to your Veracode instance using the DevOps Change Workspace playbook. * **[Onboard Veracode to DevOps Change Velocity - Service Catalog](https://www.servicenow.com/docs/_nzRDIkQqhKmt0TPIWSv2Q)** Connect your Veracode instance using the ServiceNow Service Catalog. * **[Onboard Veracode to DevOps Change Velocity - Classic](https://www.servicenow.com/docs/Dj_y1iU211IuMQbNHEkuyg)** Connect to your Veracode instance to retrieve scan results.