Notifications
Clear all
Topic starter
02/08/2026 12:29 pm
TL;DR: Embedding code scanning directly into source control shortens the path from commit to detection and gives developers feedback before merge, according to Veracode. The governance question is no longer whether scanning exists, but whether it is policy-driven, low-friction, and tied to remediation workflows that actually change outcomes.
NHIMG editorial — based on content published by Veracode: SCM Code Scanning Best Practices with Veracode
By the numbers:
- Only 44% of organisations are currently using a dedicated secrets management system.
Questions worth separating out
Q: How should security teams implement code scanning in SCM workflows?
A: Start by scanning on pull requests, merges, and other change events that already define the delivery process.
Q: Why do SCM-integrated security checks improve developer adoption?
A: They reduce context switching.
Q: What breaks when security scanning sits outside the CI/CD workflow?
A: Findings arrive too late, ownership gets blurred, and teams treat security as a separate queue instead of a release requirement.
Practitioner guidance
- Standardise scan triggers on pull requests and merges Require scanning on every pull request and merge event so detection happens before code becomes harder to unwind.
- Treat SCM automation as governed identity Inventory the tokens, apps, and service accounts that can create scans, change policies, or block builds.
- Link findings to owned remediation paths Route scan results into the same workflow developers use to fix code, then assign ownership automatically where possible.
What's in the full article
Veracode's full post covers the operational detail this post intentionally leaves for the source:
- Step-by-step SCM integration setup for GitHub, GitLab, and Azure DevOps.
- Central policy configuration options for scan frequency, branch protections, and exceptions.
- Workflow examples for auto-created issues, remediation tracking, and platform-level reporting.
- The exact developer-facing feedback format used inside pull requests and status checks.
👉 Read Veracode's analysis of SCM code scanning best practices →
SCM code scanning in CI/CD: are your controls keeping up?
Explore further
02/08/2026 1:27 pm
Workflow-native security is becoming a control requirement, not a convenience feature. The article shows that developers are more likely to act when security findings live inside the SCM rather than in a separate console. That matters because modern delivery pipelines move too quickly for detached review models to be effective. For practitioners, the real question is whether enforcement happens where code is changed, or only after risk has already moved downstream.
A question worth separating out:
Q: How should teams govern pipeline automation that can block or approve releases?
A: Treat it as privileged automation. Define who can change policies, who can override controls, and how exceptions are approved and logged. If the pipeline can alter release outcomes, it needs the same oversight, audit trail, and access review discipline as other high-risk systems.
👉 Read our full editorial: SCM code scanning is shifting security left, but governance still matters
