Has anyone used veracode for vulnerability testing of CFML - specifically via the VSCode plugin - as opposed to sending a WAR to their cloud-api?

As far as I can see it's not a supported language. Only supported for compiled code.

I use it monthly with the WAR file method. It doesn’t actually support CF

@Scott Bennett - I'd be interested in a few more details of how you go about generating the WAR file and how you process the results of the scan if you have time to elaborate...

shameless plug for Fixinator: https://fixinator.app - you can scan your CFML code for vulnerabilities and with the enterprise version you can do it all locally on your own computer (or in CI, etc)

@brettpr out of the office this morning but I can send the step by step document later today

@Scott Bennett - thanks v much - no rush though...

I actually prefer fixinator for the cfml scanning but veracode has some extra features around licensing and sich, and also picks up any vulnerabilities in the cf engine jars

Cool... Thanks @Scott Bennett - I'll give it a go - will just need to do the compile Lucee style.