Visual Code Grepper (VCG) Integration with DefectDojo

Visual Code Grepper (VCG) Integration with DefectDojo

Visual Code Grepper (VCG) is an open source static analysis tool for secure code review, published under the NCC Group organization on GitHub. It scans source code for insecure functions, risky patterns, and comments that suggest unfinished or untrusted code, using configurable lists of dangerous calls per language. VCG supports C and C++, Java, C#, VB, PL/SQL, PHP, and COBOL, with R support in beta. It runs as a Windows desktop application or in console mode, and exports results to XML, CSV, or plain text. DefectDojo imports the XML and CSV exports.

Visual Code Grepper (VCG) Integration with DefectDojo

We use VCG as a fast first pass on code bases that our main SAST tools do not cover well, especially older C, C++, and VB projects. Its output is a long list of places a reviewer should look. Importing it into DefectDojo turns that list into Findings on the Asset that owns the code, with a severity, an owner, and a place to record the reviewer's decision. When a reviewer clears a pattern as a false positive, that decision and the reasoning behind it are recorded on the Finding instead of in someone's spreadsheet.

Why VCG Matters

Not every code base gets a modern SAST pipeline. Legacy and less common languages are often the ones with the least security review and the most dangerous APIs.

• VCG covers languages such as COBOL, PL/SQL, and VB that many scanners skip or handle poorly.
• It flags known dangerous functions and patterns quickly, which makes it a practical guide for where a manual reviewer should spend time.
• Its configuration files list the functions it treats as unsafe, so teams can add their own banned APIs.
• VCG is a review aid, not a verdict. Its results need human triage, and that triage needs to be recorded somewhere it survives the next scan.

Advantages of This Integration

What we gained by routing VCG results through DefectDojo:

• Recorded triage. Reviewers mark VCG results as false positive, risk-accepted, or confirmed in DefectDojo, with notes explaining the decision.
• Priority mapped to severity. VCG's numeric priority becomes a DefectDojo severity, so confirmed issues fall under the same SLAs as other SAST tools.
• Duplicates collapsed per report. Within one export, results with the same severity, title, and description are imported once.
• Code review alongside other results. VCG Findings sit on the same Asset as SCA, DAST, and other SAST Findings, so a review of a legacy application shows everything in one place.
• Assignment and ticketing. Confirmed issues can be assigned to developers and pushed to Jira with the file, line, and offending code line in the description.

How This Integration Works

DefectDojo imports VCG results with the VCG Scan scan type. The parser chooses the format by file extension: .xml files are read as VCG XML exports (a CodeIssueCollection of CodeIssue elements), and .csv files as VCG CSV exports.

1. Produce an export. From the VCG GUI, export results to XML or CSV after a scan. To run unattended in console mode, set the target, the language, and an export file:

VisualCodeGrepper.exe -c -t C:\src\billing-service -l CS -x vcg-results.xml

Use -f vcg-results.csv instead of -x for a CSV export. Language values include CPP, PLSQL, JAVA, CS, VB, PHP, COBOL, and R; C and C++ is the default.

2. Import it. In the UI, open the Engagement, choose Import Scan Results, select VCG Scan, and upload the file. For automation, use the import API in Community Edition or DefectDojo Pro:

curl "https://YOUR_INSTANCE/api/v2/import-scan/" \
  -H "Authorization: Token $DD_API_TOKEN" \
  -F "scan_type=VCG Scan" \
  -F "file=@vcg-results.xml" \
  -F "product_name=billing-service" \
  -F "engagement_name=Code Review" \
  -F "auto_create_context=true"

DefectDojo Pro users can use Universal Importer:

universal-importer import \
  --defectdojo-url "https://YOUR_INSTANCE.cloud.defectdojo.com/" \
  --scan-type "VCG Scan" \
  --report-path "./vcg-results.xml" \
  --product-name "billing-service" \
  --engagement-name "Code Review" \
  --auto-create-context

3. Reimport after fixes. Send later exports to /api/v2/reimport-scan/ against the same Test so results that no longer appear are mitigated.

Data Granularity: What Gets Imported

The XML export also contains VCG's Checked and CheckColour review markers, which the parser does not import.

Use Cases

For legacy application reviews: A security team assessing an old C++ or VB code base runs VCG, imports the results into a Code Review Engagement, and works through them in DefectDojo, recording each decision as it goes.

As a pre-pentest guide: Before a manual test, reviewers import VCG results for the target application so testers can see which components use dangerous functions and focus their time.

For languages outside the main SAST tool: Teams whose primary scanner does not cover COBOL or PL/SQL use VCG on those repositories and import into the owning Asset, so reporting covers every language in the application.

During remediation sprints: Confirmed VCG Findings are assigned and pushed to Jira, and a later reimport shows which dangerous calls were removed.

Operational Tips

• Keep the .xml or .csv extension on the export. The parser picks the format by file name and rejects other extensions.
• The CSV parser reads columns by position and does not skip a header row. If your CSV has a header line, remove it before import, or use the XML export.
• Since file path and line are not set as Finding fields, the legacy deduplication algorithm typically does not match VCG Findings across separate imports. Reimport into the same Test rather than creating a new Test per run, and check the first reimport's results, since many VCG Findings share a title.
• Expect many Info Findings. Priorities 6 and 7, which include suspicious comments, map to Info, so set minimum_severity=Low to focus on dangerous function use.
• VCG's own severity label (for example "Suspicious Comment") is preserved in the description. Search on it when you want to work through one category at a time.
• Record the reviewer's reasoning in a note when marking a VCG Finding as a false positive, since pattern-based results are often questioned again later.