Using Passwords in the Veracode Platform

Getting Started with Veracode

The Veracode Platform protects your data in numerous ways. One of the most important ways is by securing your login so that it is not vulnerable to password guessing or brute force attack. Veracode does this by:

  • Enforcing minimum password complexity rules
  • Password expiration
  • Enforcing a user account lockout after five failed login attempts
  • Offering optional multifactor authentication

Password Complexity

Your password must meet the following criteria:

  • Contains at least eight characters
  • Includes at least one lowercase letter, uppercase letter, number, and symbol
  • Does not include your first or last name
  • Does not repeat any of your last five passwords

If you forget your password, click Need help signing in? > Forgot password? and follow the instructions for resetting a forgotten password.

Password Expiration

You must change your password once every 90 days. If your password is expired, Veracode prompts you to change the password on the log in page.

Security Question Answers

You must set up a security question and answer pair when you activate your account. Answers are not case-sensitive.

User Lockout After Five Failed Login Attempts

You can reset your password at any time. Veracode automatically locks your account for 30 minutes after five failed attempts to enter a correct password. This lockout protects your account from brute-force attacks.

If your account becomes locked out, Veracode notifies you in an email.

Optional Multifactor Authentication

Your account may require multifactor authentication (MFA) for enhanced security. The Veracode Platform supports two standards for MFA:
TOTP
To use Time-Based One-Time Password Algorithm (TOTP) authentication, you must open a TOTP application, such as Google Authenticator, on your mobile device to generate a six-digit code.
FIDO2/WebAuthn
To use FIDO2 / WebAuthn authentication, you must have a FIDO2-compliant hardware security key, such as a YubiKey or Titan Security Key or a biometric authenticator such as Windows Hello or Touch ID.

Inactivity logout

The Veracode Platform automatically ends your session and logs you out after a period of 15 minutes with no activity.