Summary
Please extend AppScan on Cloud SAST support to recognize and analyze additional COBOL source file extensions commonly used in IBM i / IBM Power / AS400 environments.
Business Need
Our organization relies on AppScan on Cloud SAST to perform static security analysis of a large COBOL codebase managed in Git repositories.
Although AppScan currently supports standard COBOL file extensions, a significant portion of our source code uses alternative COBOL extensions that are widely adopted in IBM i development environments:
As a result:
15,144 files (16.62% of our COBOL codebase) use extensions that are not currently recognized by AppScan.
These files are excluded from SAST scans unless manually renamed.
The workaround is operationally expensive, error-prone, and difficult to automate in enterprise CI/CD pipelines.
Requested Enhancement
We request one of the following capabilities:
Option 1: Native Support
Add support for the following COBOL extensions:
Option 2: Configurable Extensions
Provide an administrator setting that allows custom file extensions to be mapped to a supported programming language (COBOL in this case) during static analysis.
Business Impact
Without this capability:
Up to 16.62% of our COBOL source files may be excluded from security analysis.
Security teams cannot guarantee complete scan coverage.
Development teams must maintain temporary renaming processes before each scan.
CI/CD integration becomes more complex and less reliable.
There is a risk that security vulnerabilities remain undetected simply because source files use a different extension.
Benefits
Implementing this enhancement would:
Improve security scan coverage.
Increase adoption of AppScan in IBM i / AS400 environments.
Eliminate manual preprocessing activities.
Reduce operational costs and human errors.
Improve integration with modern DevSecOps workflows.
Provide more accurate and complete vulnerability assessments.
Use Case
Many IBM i organizations distinguish source types through dedicated extensions such as .CBLLE, .SQLCBL, and .SQLCBLLE, while the underlying language remains COBOL.
AppScan currently ignores these files based solely on their extension rather than their content, resulting in incomplete analysis of legitimate COBOL applications.
Allowing either support for these extensions or administrator-defined extension mappings would solve this limitation and significantly improve usability for IBM i customers.
Priority
High
This enhancement directly impacts scan completeness and security assurance in enterprise COBOL environments. For our organization alone, it affects more than 15,000 source files that currently require manual intervention before security analysis can be performed.
