When looking for the scanner to build our secure development process on, we evaluated the capabilities of global leading vendors. We were surprised with the very convenient licensing model along with the impressive capabilities of the product. DerScanner is an optimal solution to our main challenge of checking the health of our product's code.
Just Eat Takeaway.comInfoSec and IT Security ManagerSAST, DAST, SCA, MAST
SAST, DAST, SCA, container, IaC
DerScanner runs in the cloud, on internal servers or in a network with no internet link. Veracode states that it offers no on-premises version.
Veracode requires debug symbols for Windows C/C++ binaries and scans Apple apps only from debug builds.
DerScanner vs Veracode
DerCodeFix decompiles the package, locates the flaw and drafts a secure change. A new draft is available whenever the first one does not fit.
43 languages span SAP systems, mainframes, smart contracts and modern web stacks.
Third-party executables and mobile packages pass through static analysis with no source or symbols supplied.
DerScanner reports hidden functionality and analyzes obfuscated Android builds, which Veracode documentation excludes from scanning.
Each component receives scores for credibility, authorship, popularity and maintainer response speed.
DerTriage classifies findings and records the reasoning next to the verdict. It operates on the DerScanner server with no internet access.
Path traversal in ReportController.cs:88
TRUE POSITIVEThe file name from the request is joined to the reports folder without normalization.
Sources: Veracode documentation on supported languages, C/C++ Windows packaging, Apple platform packaging and Android packaging, September 2026.
| Capability | DerScanner | Veracode |
|---|---|---|
| AI verification of findings | Yes | No |
| AI-generated code fixes | Yes | Yes |
| AI agents run without internet access | Yes | No |
| Capability | DerScanner | Veracode |
|---|---|---|
| Vulnerability search in source code | Yes | Yes |
| Taint, semantic and control flow analysis | Yes | Yes |
| Undocumented feature search | Yes | Yes |
| Obfuscated code check | Yes | No |
| ABAP, Delphi, Pascal, LotusScript, Rust, Solidity, Vyper | Yes | No |
| RPG, Classic ASP, ColdFusion, Xamarin | No | Yes |
| Infrastructure as code and container checks | Yes | Yes |
| Capability | DerScanner | Veracode |
|---|---|---|
| JAR, WAR, EAR (Java) | Yes | Yes |
| APK (Android) | Yes | Partialobfuscated apps not supported |
| EXE, DLL (C/C++) | Yes | Partialdebug symbols (PDB) required |
| IPA (iOS) | Yes | Partialdebug builds only |
| APP (macOS) | Yes | No |
| Third-party software without source code or debug symbols | Yes | PartialJava and Android packages |
| Capability | DerScanner | Veracode |
|---|---|---|
| Transitive dependency analysis | Yes | Yes |
| SBOM file analysis | Yes | Yes |
| License risk coverage | Yes | Yes |
| Reachability analysis | Yes | Yes |
| Capability | DerScanner | Veracode |
|---|---|---|
| Web application DAST | Yes | Yes |
| SAST and DAST correlation | Yes | Yes |
| OpenAPI specification import | Yes | Yes |
| Capability | DerScanner | Veracode |
|---|---|---|
| Repository, CI/CD and issue tracker integrations | Yes | Yes |
| IDE plugins with inline findings | PartialEclipse, IntelliJ IDEA, Visual Studio plugins, findings outside the editor | Yes |
| Compliance reports (OWASP Top 10, PCI DSS, CWE/SANS) | Yes | Yes |
| Capability | DerScanner | Veracode |
|---|---|---|
| SaaS | Yes | Yes |
| On-premises | Yes | No |
| Air-gapped networks | Yes | No |
| FedRAMP authorization | No | Yes |
The Veracode column follows Veracode public documentation, reviewed September 2026.
Veracode scans continue while each application is set up in DerScanner. Release checks run the whole time.
Plan a migrationA proof of concept can run on internal servers, so the code under test stays in the network.
Prefer email? company@derscanner.com