Customize Semgrep scans or triage workflow
| Concern | Guide |
|---|---|
| Semgrep scans irrelevant files. | Ignore files, folders, or code. |
| Semgrep Code is too noisy. | Enable cross-file (interfile) analysis or remove rules and rulesets from your detection policies. |
| I want my developers to see certain security issues in their pull request or merge request. | Create a remediation policy where the action is to comment on a pull request or merge request. |
| I want to prevent developers from using dependencies with certain licenses. | Set up license compliance. |
| I want to receive AI assistance when I triage findings. | Enable Semgrep Multimodal. |
| I want multi-step, AI-enabled detection beyond rule-based scanning. | Run Semgrep Agentic Workflows (beta). |
| I want to enforce my organization’s coding standards. | Write a custom rule and add it to your detection policies. |
Enable additional deployment features
| Concern | Guide |
|---|---|
| I want to receive notifications in my environment. | Set up notifications. |
| I want my developers to use Semgrep on their IDE. | Install and set up available IDE extensions. |
| I’m scanning too many projects (repositories onboarded to Semgrep) and want to group them somehow. | Tag your projects. |
| I’d like to manage access to the resources that developers can view or change in Semgrep AppSec Platform. | Configure roles and users. |