# Semgrep: Help ## Help ### Knowledge base #### Knowledge base - [Knowledge base](https://docs.semgrep.dev/kb.md) ##### Semgrep Multimodal - [Semgrep Multimodal](https://docs.semgrep.dev/kb/semgrep-multimodal.md) - [Azure OpenAI: Error 429 - Max Tokens Exceeded](https://docs.semgrep.dev/kb/semgrep-multimodal/azure-openai-error-429.md) - [Missing PR or MR comments from Semgrep Multimodal](https://docs.semgrep.dev/kb/semgrep-multimodal/missing-pr-mr-comments.md) ##### Semgrep Code - [Semgrep Code](https://docs.semgrep.dev/kb/semgrep-code.md) - [Troubleshoot ValueError: Invalid header value error](https://docs.semgrep.dev/kb/semgrep-code/InvalidHeaderValue.md) - [How to collect logs when running Semgrep in CLI](https://docs.semgrep.dev/kb/semgrep-code/collect-cli-logs.md): When troubleshooting Semgrep scans on the command line interface (CLI), collecting and sharing logs can be extremely helpful. By default, Semgrep prints findings from a scan to `stdout`, and other messages, including scan details and progress, to `stderr`. For troubleshooting, it's best to provide b… - [Why isn’t Semgrep reporting all my tainted data flows?](https://docs.semgrep.dev/kb/semgrep-code/finding_all_taints.md): One of the reasons behind seeing fewer than expected tainted data flows could be the principle of reporting on shortest paths only. - [My GitLab pipeline says that the token is invalid, but it is valid](https://docs.semgrep.dev/kb/semgrep-code/gitlab-group-variables.md) - [Support for all versions of a programming language](https://docs.semgrep.dev/kb/semgrep-code/support-for-language-versions.md): Semgrep language support has several levels of maturity. The **Generally available (GA)** maturity level means that Semgrep broadly supports all versions of that programming language. - [Reduce false positives in semgrep scan](https://docs.semgrep.dev/kb/semgrep-code/reduce-false-positives.md): The `semgrep scan` command can be used to quickly perform SAST scans. However, you may encounter false positives as you work through your findings. This document presents different strategies to reduce false positives and increase true positives in your scans. - [How to run different versions of Semgrep](https://docs.semgrep.dev/kb/semgrep-code/run-specific-version.md): However, when testing or managing upgrades, it can be helpful to run different versions of Semgrep to compare behavior. - [Troubleshooting 'You are seeing this because the engine was killed' on monorepos](https://docs.semgrep.dev/kb/semgrep-code/scan-engine-kill.md): Scans can fail to complete on large monorepos. This article describes possible solutions, such as: - [A Semgrep scan is having a problem - what next?](https://docs.semgrep.dev/kb/semgrep-code/semgrep-scan-troubleshooting.md): If a Semgrep scan is failing or running slowly, - [Why am I getting findings in files that should be ignored?](https://docs.semgrep.dev/kb/semgrep-code/semgrepignore-ignored.md): If you don't have a `.semgrepignore` file, see our [guide on how to exclude files from Semgrep scans](/ignoring-files-folders-code). - [Why are there more Semgrep findings when the code hasn't changed?](https://docs.semgrep.dev/kb/semgrep-code/unexpected-new-findings.md): If the rules you're using in Semgrep have changed since you last performed a full scan of your project, you may see more findings for the project even if your code has not changed. ##### Semgrep Supply Chain (SSC) - [Semgrep Supply Chain (SSC)](https://docs.semgrep.dev/kb/semgrep-supply-chain.md) - [How to exclude a Semgrep Supply Chain rule from a scan](https://docs.semgrep.dev/kb/semgrep-supply-chain/exclude-rule.md) - [How to scan multiple or nested manifest files or lockfiles](https://docs.semgrep.dev/kb/semgrep-supply-chain/scanning_multiple_lockfiles.md): Semgrep Supply Chain uses manifest files or lockfiles as part of its reachability analysis to determine the exact version of a dependency that a codebase is using. Semgrep parses manifest files or lockfiles, such as: - [Generate manifest files or lockfiles for Semgrep Supply Chain in a Circle CI pipeline](https://docs.semgrep.dev/kb/semgrep-supply-chain/ssc-lockfiles-circleci.md): In CircleCI, you can generate a manifest file or lockfile for your project as part of your pipeline job. This step happens during the first job, then the manifest file or lockfile is passed to the Semgrep scan using a [workspace](https://circleci.com/workspaces/) to share files between jobs. - [Generating Python lockfiles for Semgrep Supply Chain scans](https://docs.semgrep.dev/kb/semgrep-supply-chain/ssc-python-lockfiles.md) - [Why aren't Supply Chain findings showing?](https://docs.semgrep.dev/kb/semgrep-supply-chain/why-no-findings.md) - [Connect a private registry to Semgrep](https://docs.semgrep.dev/kb/semgrep-supply-chain/connect-a-private-registry.md) - [Semgrep is not displaying Upgrade Guidance or Autofix functionality](https://docs.semgrep.dev/kb/semgrep-supply-chain/no-upgrade-guidance-or-autofix.md) - [No dependencies appear on the Dependencies page](https://docs.semgrep.dev/kb/semgrep-supply-chain/no-dependency-results.md) ##### Semgrep AppSec Platform - [Semgrep AppSec Platform](https://docs.semgrep.dev/kb/semgrep-appsec-platform.md) - [What does 'Act on your behalf' mean?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/act-on-your-behalf.md) - [Web API error 404 and token scopes](https://docs.semgrep.dev/kb/semgrep-appsec-platform/api-404-token-scope.md) - [Automate private rules deployment using the Semgrep API](https://docs.semgrep.dev/kb/semgrep-appsec-platform/automate-rules-deployment.md) - [Why can't I access my Semgrep organization after logging in with GitHub?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/cannot-access-semgrep-after-github-login.md) - [Why does the Projects page display a different dependency count from the Dependencies page?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/dependency-count-differ-platform.md): The **Projects** page displays the count of individual dependency entries in the latest full scan for the project. The **Dependencies** page shows only unique entries for a dependency, taking into account its lockfile and transitivity status. Dependencies that appear more than once indicate their li… - [error: externally-managed-environment](https://docs.semgrep.dev/kb/semgrep-appsec-platform/error-externally-managed-environment.md): If your Python environment is [externally managed by a package manager](https://packaging.python.org/en/latest/specifications/externally-managed-environments/), you can't use `pip` for system-wide installations. This results in the `externally-managed-environment` when you try to use `pip` to instal… - [FedRAMP authorization boundary for code scanning services like Semgrep](https://docs.semgrep.dev/kb/semgrep-appsec-platform/fedramp-with-semgrep.md): At Semgrep, we understand the importance of staying within the FedRAMP Authorization Boundary guidelines, especially when it comes to code security and scanning services. Many other companies agree with our understanding of the FedRAMP Authorization Boundary guidance (Section 7) which stipulates tha… - [Why do the findings count differ in the API and the Semgrep AppSec Platform UI?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/findings-count-differ-api-platform.md) - [Why are findings counts different across Semgrep AppSec Platform pages?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/findings-count-differ-platform.md): You may see different findings counts across the [Dashboard](/semgrep-appsec-platform/dashboard), [Projects](/deployment/manage-projects), [Scans](/deployment/manage-projects#scan-details-and-logs), and Findings pages in Semgrep AppSec Platform. This is typically due to the filtering criteria used t… - [Why did the comments on a PR or MR not appear inline?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/inline-pr-comments.md): When Semgrep comments on PR or MR findings, the comments are usually posted on the line of code where the finding is identified (inline). However, there are two common reasons why comments may not appear inline. - [Why is my repository not receiving PR or MR comments?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/missing-pr-comments.md): If you have configured Semgrep in CI and Semgrep AppSec Platform to create comments when a rule generates a finding in a PR or MR, but you are not seeing those comments, review the following possibilities. - [Semgrep Managed Scans doesn't run for pull requests in GitHub merge queues](https://docs.semgrep.dev/kb/semgrep-appsec-platform/no-runs-in-github-merge-queues.md) - [Why are my projects showing a status of 'Not yet started' after I enable Managed Scans?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/projects-not-yet-started-sms.md): When onboarding a large number of projects to Semgrep Managed Scans (SMS), users may notice that many of them show a 'Not yet started' status, even after enabling Managed Scans. This is because Semgrep doesn't trigger scans for all projects at once. Instead, Semgrep scans the repositories over time… - [Remove users from your Semgrep AppSec Platform organization](https://docs.semgrep.dev/kb/semgrep-appsec-platform/remove-users.md) - [How to re-run a Semgrep Managed Scan](https://docs.semgrep.dev/kb/semgrep-appsec-platform/rerun-managed-scans.md) - [SAML SSO error: There is no AttributeStatement on the Response](https://docs.semgrep.dev/kb/semgrep-appsec-platform/saml-attributestatement.md) - [SAML SSO Error: Authentication method doesn't match requested](https://docs.semgrep.dev/kb/semgrep-appsec-platform/saml-authentication-method-match.md) - [SAML SSO Error: Signature validation failed](https://docs.semgrep.dev/kb/semgrep-appsec-platform/saml-bad-signature.md) - [SAML SSO with Google Workspace](https://docs.semgrep.dev/kb/semgrep-appsec-platform/saml-google-workspace.md) - [SAML SSO with Microsoft Entra ID](https://docs.semgrep.dev/kb/semgrep-appsec-platform/saml-microsoft-entra-id.md) - [Troubleshooting SAML SSO](https://docs.semgrep.dev/kb/semgrep-appsec-platform/saml-stops-working.md): This article walks you through troubleshooting SAML SSO failures, including the case where your SAML configuration stops working after you've successfully configured it and used it for some time. There are several common reasons why a configuration may fail. - [Why is the scan duration reported by Semgrep different from the scan duration of the end-to-end process of running a diff-aware managed scan?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/scan-duration-discrepancy.md): The **Duration** of a scan shown on Semgrep AppSec Platform's **Projects** page reflects the amount of time required to run the Semgrep scan. This timer begins when Semgrep sends the scan request and receives a scan identifier, and ends when Semgrep sends results and receives a `scan complete` respo… - [Search, filter, and sort findings in Semgrep AppSec Platform](https://docs.semgrep.dev/kb/semgrep-appsec-platform/search-filter-sort-findings.md): Semgrep AppSec Platform provides you with an overview of the findings identified by Semgrep Code, Supply Chain, and Secrets. Each product-specific page provides you with filters to narrow down the list of findings shown to you. For example, you can filter for Semgrep Code findings that are flagged a… - [The semgrep login command doesn't redirect to my Semgrep tenant site](https://docs.semgrep.dev/kb/semgrep-appsec-platform/semgrep-login-cli-tenant.md) - [SAML SSO error BadRequest: Missing attribute](https://docs.semgrep.dev/kb/semgrep-appsec-platform/sso-attribute-error.md): When setting up SAML-based SSO for Semgrep AppSec Platform, you may see the following error: - [Why am I seeing a "No SCMs with code access found" error when enabling code snippets in AI prompts?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/gitlab-no-scms-with-code-access-found.md) - [Why are some of my findings in Open status instead of Provisionally ignored when Semgrep has also flagged the findings as False positives?](https://docs.semgrep.dev/kb/semgrep-appsec-platform/findings-in-open-not-provisionally-ignored.md) ##### Semgrep Secrets - [Semgrep Secrets](https://docs.semgrep.dev/kb/semgrep-secrets.md) - [Why didn't Semgrep Secrets find these example secrets?](https://docs.semgrep.dev/kb/semgrep-secrets/no-example-secrets-found.md): One common pattern in code is to include a placeholder value or format indicator for a secret rather than a real secret value. Where possible, Semgrep Secrets rules are intentionally written to minimize matches with this type of placeholder to avoid false positives, since the primary concern is iden… - [Why didn't Semgrep ignore the files and folders in the Secrets Path ignores for this project?](https://docs.semgrep.dev/kb/semgrep-secrets/per-product-ignore-not-working.md): The Semgrep AppSec Platform allows you to [define ignore patterns](/ignoring-files-folders-code#define-ignored-files-and-folders-in-semgrep-appsec-platform) for different Semgrep products for each project. Product-specific ignores for Semgrep Secrets require Semgrep version `1.71.0` or later in your… ##### Semgrep in CI - [Semgrep in CI](https://docs.semgrep.dev/kb/semgrep-ci.md) - [Semgrep with self-hosted Ubuntu runners in Azure Pipelines](https://docs.semgrep.dev/kb/semgrep-ci/azure-self-hosted-ubuntu.md) - [Running Semgrep using templates in Azure Pipelines](https://docs.semgrep.dev/kb/semgrep-ci/azure-using-templates-with-semgrep.md) - [Run Semgrep in Jenkins when using Bitbucket as the source code manager](https://docs.semgrep.dev/kb/semgrep-ci/bitbucket-jenkins.md) - [Semgrep in CI vs CLI: align your SAST scan results and understand differences](https://docs.semgrep.dev/kb/semgrep-ci/ci-vs-cli.md) - [Collecting Semgrep GitHub Actions logs from GitHub](https://docs.semgrep.dev/kb/semgrep-ci/collect-gha-logs.md) - [GitLab 'Job's log exceeded limit' error](https://docs.semgrep.dev/kb/semgrep-ci/collect-gitlab-logs.md) - [Failed to run a git command during a pull request or merge request scan](https://docs.semgrep.dev/kb/semgrep-ci/git-command-errors.md) - [Use GitHub repository rulesets to implement Semgrep](https://docs.semgrep.dev/kb/semgrep-ci/github-repository-rulesets-semgrep.md) - [Set up reusable GitHub workflows for Semgrep scans](https://docs.semgrep.dev/kb/semgrep-ci/github-reusable-workflows-semgrep.md) - [Why aren't findings populating in the GitHub Advanced Security Dashboard after running Semgrep in CI?](https://docs.semgrep.dev/kb/semgrep-ci/github-upload-findings-in-security-dashboard.md): When scanning with Semgrep in CI, findings automatically populate in Semgrep AppSec Platform. To show findings in the GitHub Advanced Security Dashboard, run an alternate job that uploads findings to the dashboard in the form of a `SARIF` file. See [Sample GitHub Actions configuration file](/semgrep… - [Scan GitHub projects in Jenkins](https://docs.semgrep.dev/kb/semgrep-ci/jenkins-diff-scans.md) - [Receive Semgrep MR comments through a GitLab runner](https://docs.semgrep.dev/kb/semgrep-ci/mr-comments-through-gitlab-runner.md) - [Why are there new source code manager (SCM) connections that I didn't manually configure listed in Semgrep AppSec Platform?](https://docs.semgrep.dev/kb/semgrep-ci/new-scm-connections.md) - [Does Semgrep scan compressed files or other non-code files?](https://docs.semgrep.dev/kb/semgrep-ci/scan-compressed-files-artifacts.md) - [Scanning a monorepo in parts](https://docs.semgrep.dev/kb/semgrep-ci/scan-monorepo-in-parts.md) - [Add Semgrep to your Semaphore pipeline](https://docs.semgrep.dev/kb/semgrep-ci/semaphore-pipelines.md) - [How to trigger diff-aware scans](https://docs.semgrep.dev/kb/semgrep-ci/trigger-diff-scans-env-var.md) - [Upload Semgrep CI findings to GitHub Advanced Security Dashboard](https://docs.semgrep.dev/kb/semgrep-ci/upload-ci-findings-to-github.md) - [Upload Semgrep CI findings to GitLab Security Dashboard](https://docs.semgrep.dev/kb/semgrep-ci/upload-ci-findings-to-gitlab.md) - [Configure GitHub Actions to use the nonroot Semgrep docker image](https://docs.semgrep.dev/kb/semgrep-ci/using-nonroot-docker-image-with-gha.md) - [Why are duplicate findings appearing after running Semgrep in CI?](https://docs.semgrep.dev/kb/semgrep-ci/why-duplicate-findings.md) ##### Integrations - [Integrations](https://docs.semgrep.dev/kb/integrations.md) - [Customize Semgrep in pre-commit](https://docs.semgrep.dev/kb/integrations/customize-semgrep-precommit.md) - [How to connect Semgrep and DefectDojo](https://docs.semgrep.dev/kb/integrations/defect-dojo-integration.md) - [How to paginate responses from the Semgrep API](https://docs.semgrep.dev/kb/integrations/pagination.md) ##### Rules - [Rules](https://docs.semgrep.dev/kb/rules.md) - [Change rule severity and other metadata by forking rules](https://docs.semgrep.dev/kb/rules/changing-rule-severity-and-other-metadata.md) - [Matching multiple tokens with ellipsis metavariables](https://docs.semgrep.dev/kb/rules/ellipsis-metavariables.md) - [How to exclude certain file types for a particular rule](https://docs.semgrep.dev/kb/rules/exclude_rule_for_certain_filetypes.md) - [Match the absence of something in a file](https://docs.semgrep.dev/kb/rules/match-absence.md) - [Match comments with Semgrep](https://docs.semgrep.dev/kb/rules/match-comments.md) - [Fix pattern parse errors when running rules](https://docs.semgrep.dev/kb/rules/pattern-parse-error.md) - [Rule upgrades and supersession](https://docs.semgrep.dev/kb/rules/pro-vs-community-secrets-vs-code-rules.md): This article describes Semgrep behavior when multiple rules match the same issue in the same code. Overlap can occur when you scan your project with Semgrep Code using similar **Pro** and **CE** rules, or when you scan your code using both **Semgrep Code** and **Semgrep Secrets**. - [Performance principles for rules and files to abide by when scanning repositories](https://docs.semgrep.dev/kb/rules/rule-file-perf-principles.md) - [Run all available rules on a repository](https://docs.semgrep.dev/kb/rules/run-all-available-rules.md) - [How does Semgrep assign severity levels to rules?](https://docs.semgrep.dev/kb/rules/understand-severities.md) - [My rule with pattern-not doesn't work: using pattern-not-inside](https://docs.semgrep.dev/kb/rules/using-pattern-not-inside.md) - [Use the Semgrep rule schema to write rules in VS Code](https://docs.semgrep.dev/kb/rules/using-semgrep-rule-schema-in-vscode.md) ### Support #### Support & resources - [Support](https://docs.semgrep.dev/support.md): This document provides various methods for all users of Semgrep to get help. - [Licensing](https://docs.semgrep.dev/licensing.md): The following is a list of products offered by Semgrep, Inc., along with their license information. - [Semgrep trophy case](https://docs.semgrep.dev/trophy-case.md): This is a list of vulnerabilities found and security fixes made with Semgrep. - [Run a successful proof-of-value (POV) trial with Semgrep](https://docs.semgrep.dev/run-a-successful-pov.md) - [Semgrep metrics](https://docs.semgrep.dev/metrics-1.md): Semgrep CLI may collect aggregate metrics to help improve the product. This document describes: - [Security](https://docs.semgrep.dev/security.md) ##### Usage and billing - [Usage and billing](https://docs.semgrep.dev/usage-and-billing/overview.md): This document provides information on how Semgrep calculates usage for billing purposes and is intended for users with paid Semgrep Code, Supply Chain, or Secrets licenses. - [Claim a license](https://docs.semgrep.dev/deployment/claim-a-license.md): Once you've purchased a subscription, you should receive an email from Semgrep with your license information. Follow the instructions provided in the email to claim your license and begin onboarding your Semgrep products. - [Upgrade your Semgrep subscription plan](https://docs.semgrep.dev/usage-and-billing/plan-changes-and-payments.md): To upgrade your Semgrep subscription from the **Free** plan to the **Team** plan using a credit card as the payment method: - [How Semgrep calculates contributor count](https://docs.semgrep.dev/usage-and-billing/contributor-count-explained.md) - [Additional usage and reconciliation of licenses](https://docs.semgrep.dev/usage-and-billing/reconciliation.md): If your organization uses more licenses than purchased for the contract period, you will be charged for each extra license starting the month after the overage occurs. ##### Compliance - [Compliance](https://docs.semgrep.dev/compliance/compliance-overview.md): Semgrep provides security tooling that can support compliance efforts, but does not guarantee compliance. Organizations remain responsible for meeting all compliance requirements. Consult with your compliance team and auditors to determine how Semgrep fits into your compliance program. - [FedRAMP compliance](https://docs.semgrep.dev/compliance/fedramp.md) - [GDPR compliance](https://docs.semgrep.dev/compliance/gdpr.md) - [HIPAA/HITRUST compliance](https://docs.semgrep.dev/compliance/hipaa-hitrust.md) - [ISO 27001 compliance](https://docs.semgrep.dev/compliance/iso27001.md) - [ISO 27017 compliance](https://docs.semgrep.dev/compliance/iso-27017.md) - [NIST 800-171 compliance](https://docs.semgrep.dev/compliance/nist-800-171.md) - [PCI DSS compliance](https://docs.semgrep.dev/compliance/pci-dss.md) - [SOC 2 compliance](https://docs.semgrep.dev/compliance/soc2.md) ##### Contribute to Semgrep - [Contributing overview](https://docs.semgrep.dev/contributing/contributing.md): Your contributions to Semgrep Community Edition (CE) are welcome! - [Contribute rules to the Semgrep Registry](https://docs.semgrep.dev/contributing/contributing-to-semgrep-rules-repository.md) - [Contributing code](https://docs.semgrep.dev/contributing/contributing-code.md) - [semgrep-core contributing](https://docs.semgrep.dev/contributing/semgrep-core-contributing.md) - [semgrep-cli contributing](https://docs.semgrep.dev/contributing/semgrep-contributing.md) - [How to add support for a new language](https://docs.semgrep.dev/contributing/adding-a-language.md) - [How to upgrade the grammar for a language](https://docs.semgrep.dev/contributing/updating-a-grammar.md) - [Troubleshooting](https://docs.semgrep.dev/contributing/troubleshooting.md)