# Semgrep: Scan with Semgrep

## Scan with Semgrep

### Get started

- [Quickstart](https://docs.semgrep.dev/getting-started/quickstart.md): Learn how to set up Semgrep, scan your first project, which can be any codebase, repository, or folder within a monorepo, for security issues, and view your findings.
- [Quickstart for Semgrep Managed Scans](https://docs.semgrep.dev/getting-started/quickstart-managed-scans.md): This quickstart guide will help you set up Semgrep and scan your first project using Semgrep Managed Scans.
- [Prerequisites](https://docs.semgrep.dev/prerequisites.md): This document details the required software or services to run Semgrep products.
- [Supported source code managers](https://docs.semgrep.dev/getting-started/scm-support.md): Semgrep supports the following source code managers (SCM) and plans to varying degrees. Please review the information for your specific SCM and plan to see what Semgrep features are available to you.

#### Supported languages

- [Supported languages](https://docs.semgrep.dev/supported-languages.md)
- [C# support](https://docs.semgrep.dev/languages/csharp.md)
- [Go support](https://docs.semgrep.dev/languages/go.md)
- [Java support](https://docs.semgrep.dev/languages/java.md)
- [JavaScript support](https://docs.semgrep.dev/languages/javascript.md)
- [Kotlin support](https://docs.semgrep.dev/languages/kotlin.md)
- [Python support](https://docs.semgrep.dev/languages/python.md)
- [Ruby support](https://docs.semgrep.dev/languages/ruby.md)
- [Scala support](https://docs.semgrep.dev/languages/scala.md)
- [Swift support](https://docs.semgrep.dev/languages/swift.md)

#### Local and CLI scans

- [Local and CLI scans](https://docs.semgrep.dev/category/local-and-cli-scans.md)
- [Local scans with Semgrep](https://docs.semgrep.dev/getting-started/cli.md): Learn how to set up Semgrep, scan your project for security issues using Semgrep Code's interfile analysis, and view your findings in the CLI.
- [Run rules](https://docs.semgrep.dev/running-rules.md): This document explains how to use local Semgrep rules when scanning your project.
- [Update Semgrep](https://docs.semgrep.dev/update.md): Stay up-to-date by running the latest version of Semgrep automatically in CI or your local CLI.
- [Scan local repositories and upload findings](https://docs.semgrep.dev/deployment/local-to-scp-scans.md)
- [Troubleshooting the CLI](https://docs.semgrep.dev/troubleshooting/semgrep.md)

### Set up and deploy scans

- [Dashboard](https://docs.semgrep.dev/semgrep-appsec-platform/dashboard.md)

#### Core deployment

- [Core deployment](https://docs.semgrep.dev/deployment/core-deployment.md): Semgrep can be set up to scan repositories of any size.
- [Pre-deployment checklist](https://docs.semgrep.dev/deployment/checklist.md): Confirm your deployment scope, access, and setup requirements before deploying Semgrep.
- [Create a Semgrep account and set up organizations](https://docs.semgrep.dev/deployment/create-account-and-orgs.md)
- [Single-sign on (SSO) configuration](https://docs.semgrep.dev/deployment/sso.md)
- [Connect a source code manager](https://docs.semgrep.dev/deployment/connect-scm.md)
- [Source code manager permissions](https://docs.semgrep.dev/deployment/prepare/scm-permissions.md): Reference for source code manager permissions required by Semgrep features
- [Enable source code manager code access](https://docs.semgrep.dev/semgrep-appsec-platform/scm-code-access.md)
- [Network access and allowlists](https://docs.semgrep.dev/deployment/prepare/network-access.md): Configure ingress and egress allowlists, IP addresses, and Semgrep Network Broker so Semgrep can reach your SCM and related services.
- [Developer exception requests (beta)](https://docs.semgrep.dev/semgrep-appsec-platform/developer-exception-requests.md)

##### Scan repositories with the AppSec Platform

- [Scan repositories with the AppSec Platform](https://docs.semgrep.dev/category/scan-repositories-with-the-appsec-platform.md)
- [Add Semgrep to CI](https://docs.semgrep.dev/deployment/add-semgrep-to-ci.md)
- [Add Semgrep manually to CI providers](https://docs.semgrep.dev/deployment/add-semgrep-to-other-ci-providers.md)
- [Customize your CI job](https://docs.semgrep.dev/deployment/customize-ci-jobs.md)
- [Handling blocking findings and errors](https://docs.semgrep.dev/semgrep-ci/configuring-blocking-and-errors-in-ci.md): This article documents how Semgrep handles blocking findings and errors and how you can change Semgrep's default behavior.
- [Manage projects](https://docs.semgrep.dev/deployment/manage-projects.md): View, sort, and tag your projects through the **Projects** page. Refer to this page to manage and troubleshoot thousands of repositories by identifying scan issues or scans with a high number of findings.
- [Set a primary branch](https://docs.semgrep.dev/deployment/primary-branch.md)
- [Troubleshooting CI scans](https://docs.semgrep.dev/troubleshooting/semgrep-app.md)

###### Managed Scans

- [Semgrep Managed Scans](https://docs.semgrep.dev/deployment/managed-scanning/overview.md): Add repositories to your Semgrep organization in bulk without adding or changing your existing CI workflows through **Managed Scans**. Similar to CI workflows, Managed Scans also integrates into developer workflows through pull request (PR) or merge request (MR) comments.
- [Add an Azure DevOps repository to Semgrep Managed Scans](https://docs.semgrep.dev/deployment/managed-scanning/azure.md)
- [Add a Bitbucket repository to Semgrep Managed Scans](https://docs.semgrep.dev/deployment/managed-scanning/bitbucket.md): Add Bitbucket repositories to your Semgrep organization in bulk without adding or changing your existing CI workflows through **Managed Scans**.
- [Add a GitHub repository to Semgrep Managed Scans](https://docs.semgrep.dev/deployment/managed-scanning/github.md): Add GitHub repositories to your Semgrep organization in bulk without adding or changing your existing CI workflows through **Managed Scans**.
- [Add a GitLab repository to Semgrep Managed Scans](https://docs.semgrep.dev/deployment/managed-scanning/gitlab.md): Add GitLab repositories to your Semgrep organization in bulk without adding or changing your existing CI workflows through **Managed Scans**.

###### AI-powered detection

- [AI-powered detection overview](https://docs.semgrep.dev/semgrep-code/ai-powered-detection-concepts.md)
- [Scan with AI-powered detection](https://docs.semgrep.dev/deployment/add-ai-to-scans.md)

###### Configuring SCA scans

- [Set up Semgrep Supply Chain for your infrastructure](https://docs.semgrep.dev/semgrep-supply-chain/setup-infrastructure.md)
- [Set up Semgrep Supply Chain with Apache Maven (Java)](https://docs.semgrep.dev/semgrep-supply-chain/setup-maven.md)

##### PR or MR comments

- [PR or MR comments](https://docs.semgrep.dev/category/pr-or-mr-comments.md)
- [Enable Azure pull request comments](https://docs.semgrep.dev/semgrep-appsec-platform/azure-pr-comments.md)
- [Set up GitHub pull request comments](https://docs.semgrep.dev/semgrep-appsec-platform/github-pr-comments.md)
- [Set up GitLab merge request comments](https://docs.semgrep.dev/semgrep-appsec-platform/gitlab-mr-comments.md)

###### Bitbucket PR comments

- [Bitbucket PR comments](https://docs.semgrep.dev/category/bitbucket-pr-comments.md)
- [Enable Bitbucket Cloud pull request comments](https://docs.semgrep.dev/semgrep-appsec-platform/bitbucket-cloud-pr-comments.md)
- [Enable Bitbucket Data Center pull request comments](https://docs.semgrep.dev/semgrep-appsec-platform/bitbucket-data-center-pr-comments.md)

##### Customize core deployment

- [Customize a core deployment](https://docs.semgrep.dev/deployment/beyond-core-deployment.md): Now that you've finished your Semgrep core deployment, you can either customize Semgrep's scan behavior or continue to enable additional deployment features. The following sections list common tasks after you've finished your core deployment.
- [Perform cross-file analysis](https://docs.semgrep.dev/semgrep-code/semgrep-pro-engine-intro.md): Use Semgrep Code's **cross-file (interfile) analysis** to detect vulnerabilities across files and folders within a project.
- [License compliance](https://docs.semgrep.dev/semgrep-supply-chain/license-compliance.md)
- [Write rules](https://docs.semgrep.dev/writing-rules/overview-1.md): Semgrep uses rules, which encapsulate pattern matching logic and data flow analysis, to scan your code for security issues, style violations, bugs, and more. In addition to rules available to you in the Semgrep Registry, you can write custom rules to determine what Semgrep detects in your repositori…

###### Ignore files, folders, and code

- [Ignore files, folders, and code](https://docs.semgrep.dev/ignoring-files-folders-code.md)
- [Ignore manifest files, lockfiles, and dependencies](https://docs.semgrep.dev/semgrep-supply-chain/ignoring-dependencies.md)

###### Unified Policies

- [Unified Policies](https://docs.semgrep.dev/semgrep-appsec-platform/unified-policies/overview.md)
- [Create and manage Unified Policies](https://docs.semgrep.dev/semgrep-appsec-platform/unified-policies/get-started.md)

#### Deployment at scale

- [Deployment at scale](https://docs.semgrep.dev/category/deployment-at-scale.md)
- [Access tokens](https://docs.semgrep.dev/deployment/tokens.md): An access token is a secure credential used to authorize requests to Semgrep AppSec Platform or the Semgrep API without a username and password. Each token is associated with a specific Semgrep account and has a defined set of [scopes](#token-scopes) that determine the permissions granted to its bea…
- [Tag projects](https://docs.semgrep.dev/semgrep-appsec-platform/tags.md): Tagging enables you to group projects together based on your organization's unique business structure or needs. By tagging projects, you are able to quickly apply Supply Chain policies and other Semgrep features to specific groups.
- [Set up Semgrep Network Broker](https://docs.semgrep.dev/semgrep-ci/network-broker.md): Semgrep Network Broker facilitates secure access between Semgrep and your private network. The Network Broker creates a WireGuard VPN tunnel to the Semgrep backend and proxies **inbound** HTTP requests from Semgrep to the customer through the tunnel. This allows Semgrep to communicate with private n…

##### Teams and users

- [Manage user access to projects](https://docs.semgrep.dev/deployment/teams/overview.md): Basic access control, which determines which users can manage Semgrep resources such as scans, projects, and findings, is managed in Semgrep AppSec Platform. This allows you to configure different levels of collaboration and visibility for users in your organization with access to Semgrep.
- [Manage teams and roles](https://docs.semgrep.dev/deployment/teams/manage.md)

#### Secure guardrails

- [Secure guardrails in Semgrep](https://docs.semgrep.dev/secure-guardrails/secure-guardrails-in-semgrep.md): Secure guardrails guide **developers** towards fixing security issues in the early stages of development. By deploying secure guardrails, you can:
- [Secure defaults](https://docs.semgrep.dev/secure-guardrails/secure-defaults.md)
- [Custom rules for secure guardrails](https://docs.semgrep.dev/secure-guardrails/custom-guardrails-rules.md): You can create custom Semgrep rules and deploy them as guardrails to enforce your organization's secure coding conventions.

#### Notifications

- [Alerts and notifications](https://docs.semgrep.dev/semgrep-appsec-platform/notifications.md): You can receive notifications for Semgrep findings in the following channels:
- [Receive Slack notifications](https://docs.semgrep.dev/semgrep-appsec-platform/slack-notifications.md)
- [Receive email notifications](https://docs.semgrep.dev/semgrep-appsec-platform/email-notifications.md): You can receive emails from Semgrep regarding **new findings** and **failed scans**.
- [Enable webhooks](https://docs.semgrep.dev/semgrep-appsec-platform/webhooks.md): Webhooks are a generic method for Semgrep AppSec Platform to post JSON-formatted objects to your URL endpoint.

#### Extensions

- [Extensions](https://docs.semgrep.dev/extensions/overview.md): Several third-party tools include Semgrep extensions.
- [Semgrep Visual Studio Code extension](https://docs.semgrep.dev/extensions/semgrep-vs-code.md)
- [Semgrep IntelliJ extension](https://docs.semgrep.dev/extensions/semgrep-intellij.md)
- [Run scans on pre-commit](https://docs.semgrep.dev/extensions/pre-commit.md)

#### Integrations

- [View exposure and runtime context from Cortex by Palo Alto Networks](https://docs.semgrep.dev/semgrep-appsec-platform/cortex.md): The Semgrep Cortex integration can ingest exposure and runtime context from your Cortex instance in Semgrep AppSec Platform. This allows you to prioritize findings based on deployment status and internet exposure status.
- [Create Jira tickets](https://docs.semgrep.dev/semgrep-appsec-platform/jira.md): The Semgrep Jira integration allows you to create Jira tickets based on your Semgrep Code, Supply Chain, and Secrets findings.
- [View runtime context from Sysdig](https://docs.semgrep.dev/semgrep-appsec-platform/sysdig.md): The Semgrep Sysdig integration can ingest runtime context from your Sysdig account into Semgrep AppSec Platform. This allows you to prioritize findings based on deployment status.
- [View Semgrep findings in Wiz's Security Graph](https://docs.semgrep.dev/semgrep-appsec-platform/wiz.md)

##### Semgrep Guardian

- [Semgrep Guardian](https://docs.semgrep.dev/semgrep-guardian/overview.md): Set up Semgrep Guardian to scan AI-generated code and catch security issues before they ship.
- [Semgrep Guardian enterprise deployment](https://docs.semgrep.dev/semgrep-guardian/enterprise-deployment.md): How to deploy Semgrep Guardian in your enterprise environment.

### Scan and triage

#### SAST (Code)

- [Semgrep Code overview](https://docs.semgrep.dev/semgrep-code/overview.md)
- [Remove duplicate findings](https://docs.semgrep.dev/semgrep-code/remove-duplicates.md): Semgrep scans are performed on both mainline (trunk) and non-mainline branches. The scope of the scan can differ depending on if Semgrep is called on a mainline or non-mainline branch.

##### AI-powered detection

- [AI-powered detection overview](https://docs.semgrep.dev/semgrep-code/ai-powered-detection-concepts.md)
- [Scan with AI-powered detection](https://docs.semgrep.dev/deployment/add-ai-to-scans.md)

##### View findings

- [View findings in Semgrep AppSec Platform](https://docs.semgrep.dev/semgrep-code/findings.md)
- [View findings' details](https://docs.semgrep.dev/semgrep-code/finding-details.md)

##### Triage and remediation

- [Triage and remediate findings](https://docs.semgrep.dev/semgrep-code/triage-remediation.md): This article shows you how to manage and triage findings identified by Semgrep Code using Semgrep AppSec Platform. The specific actions available to you when managing your findings include:
- [Autofix for Semgrep Code](https://docs.semgrep.dev/semgrep-code/triage-remediation/autofix.md): Semgrep's Autofix feature uses AI to generate proposed code changes for Semgrep Code findings and open a draft pull or merge request.

##### Manage rules and policies

- [Manage rules and policies](https://docs.semgrep.dev/semgrep-code/policies.md)
- [Semgrep Pro rules](https://docs.semgrep.dev/semgrep-code/pro-rules.md)
- [ Write rules using Semgrep Editor](https://docs.semgrep.dev/semgrep-code/editor.md)

##### Perform cross-file analysis

- [Perform cross-file analysis](https://docs.semgrep.dev/semgrep-code/semgrep-pro-engine-intro.md): Use Semgrep Code's **cross-file (interfile) analysis** to detect vulnerabilities across files and folders within a project.
- [Cross-file analysis examples](https://docs.semgrep.dev/semgrep-code/semgrep-pro-engine-examples.md)

#### SCA (Supply Chain)

- [Overview](https://docs.semgrep.dev/semgrep-supply-chain/overview.md): Semgrep Supply Chain is a software composition analysis (SCA) tool that detects security vulnerabilities in your codebase introduced by open source dependencies.
- [Supply Chain requirements and feature support](https://docs.semgrep.dev/semgrep-supply-chain/requirements-and-feature-support.md): This document discusses the requirements to use Supply Chain and the features supported by Semgrep Supply Chain.
- [Set up and configure Supply Chain scans](https://docs.semgrep.dev/semgrep-supply-chain/set-up-and-configure.md): Learn about the setup needed to scan your project with Semgrep Supply Chain and its configuration and customization options.
- [License compliance](https://docs.semgrep.dev/semgrep-supply-chain/license-compliance.md)
- [Generate a software bill of materials](https://docs.semgrep.dev/semgrep-supply-chain/sbom.md)

##### Detect vulnerabilities

- [View advisories and search for related findings](https://docs.semgrep.dev/semgrep-supply-chain/advisories.md)
- [View and search for dependencies](https://docs.semgrep.dev/semgrep-supply-chain/dependency-search.md)
- [View Dependency paths (beta)](https://docs.semgrep.dev/semgrep-supply-chain/dependency-paths.md)

###### View findings

- [View findings in Semgrep AppSec Platform](https://docs.semgrep.dev/semgrep-supply-chain/findings.md)
- [View finding details](https://docs.semgrep.dev/semgrep-supply-chain/finding-details.md): Learn how to view details about a specific Supply Chain finding in Semgrep AppSec Platform.

##### Triage and fix vulnerabilities

- [Triage and fix Supply Chain findings](https://docs.semgrep.dev/semgrep-supply-chain/triage-and-fix/overview.md)
- [Upgrade Guidance (beta)](https://docs.semgrep.dev/semgrep-supply-chain/upgrade-guidance.md): Use Upgrade Guidance to identify safe dependency upgrades and understand potential breaking changes.
- [Supply Chain Autofix](https://docs.semgrep.dev/semgrep-supply-chain/autofix.md): Open a pull request or merge request that upgrades a vulnerable dependency to a fixed version.

##### Policies

- [Manage rules and policies](https://docs.semgrep.dev/semgrep-supply-chain/policies.md)
- [Ignore manifest files, lockfiles, and dependencies](https://docs.semgrep.dev/semgrep-supply-chain/ignoring-deps.md)

##### Malware detection and response

- [Detect and remove malicious dependencies](https://docs.semgrep.dev/semgrep-supply-chain/malicious-dependencies.md)
- [Supply Chain incident notifications and response](https://docs.semgrep.dev/semgrep-supply-chain/incident-notifications.md): Get notifications when Semgrep declares a new Supply Chain incident, learn whether it affects your projects, and respond.
- [Respond to a malware incident with Semgrep Supply Chain](https://docs.semgrep.dev/semgrep-supply-chain/incident-response.md): How to respond to a malicious dependency incident using Semgrep Supply Chain.

#### Secrets

- [Semgrep Secrets overview](https://docs.semgrep.dev/semgrep-secrets/conceptual-overview.md)
- [Triage and remediate findings](https://docs.semgrep.dev/semgrep-secrets/triage-remediation.md): This article shows you how to manage and triage the findings identified by Semgrep Secrets using Semgrep AppSec Platform.
- [Manage rules and policies](https://docs.semgrep.dev/semgrep-secrets/policies.md)
- [Semgrep Secrets rule structure and sample](https://docs.semgrep.dev/semgrep-secrets/rules-1.md): This article walks you through writing, publishing, and using Semgrep Secrets rules. It also demonstrates what a sample Semgrep Secrets rule looks like, with subsequent sections describing the key-value pairs in the context of a Semgrep Secrets rule.
- [Write custom validators](https://docs.semgrep.dev/semgrep-secrets/validators-1.md)
- [Semgrep Secrets glossary](https://docs.semgrep.dev/semgrep-secrets/glossary.md): The terms and definitions provided here are specific to Semgrep Secrets.

##### Scan for secrets

- [Scan for secrets](https://docs.semgrep.dev/semgrep-secrets/getting-started.md): Semgrep Secrets allows you to detect and triage leaked secrets and credentials and save time by prioritizing which secrets to rotate based on whether they're active and in use.
- [Scan your Git history (beta)](https://docs.semgrep.dev/semgrep-secrets/historical-scanning.md)
- [Generic secrets AI](https://docs.semgrep.dev/semgrep-secrets/generic-secrets.md)

##### View findings

- [View findings in Semgrep AppSec Platform](https://docs.semgrep.dev/semgrep-secrets/findings.md)
- [View findings details](https://docs.semgrep.dev/semgrep-secrets/finding-details.md): The finding's details page displays in-depth information about the finding, including:

#### Agentic Workflows

- [Semgrep Agentic Workflows (beta)](https://docs.semgrep.dev/workflows/overview.md): Learn how Semgrep Agentic Workflows run multi-step AI-enabled detection on a repository.
- [Get started with Semgrep Agentic Workflows (beta)](https://docs.semgrep.dev/workflows/get-started.md): Run Semgrep Agentic Workflows from Semgrep AppSec Platform and review issues.

### Semgrep Multimodal

- [Analyze Code findings](https://docs.semgrep.dev/semgrep-multimodal/analyze.md)
- [Data privacy and legal considerations](https://docs.semgrep.dev/semgrep-multimodal/privacy.md): Semgrep Multimodal uses API permissions to access code in your selected GitHub or GitLab repositories. To provide AI-powered functionality, portions of the source code are processed by Semgrep's AI model vendors.

#### Overview

- [Semgrep Multimodal overview](https://docs.semgrep.dev/semgrep-multimodal/overview.md): Semgrep Multimodal adds AI-driven capabilities to Semgrep, including AI-powered detection, triage, and remediation of your findings.
- [Semgrep Multimodal metrics and methodology](https://docs.semgrep.dev/semgrep-multimodal/metrics.md): Metrics for evaluating Semgrep Multimodal's performance are derived from two sources:

#### Getting started

- [Enable Semgrep Multimodal](https://docs.semgrep.dev/semgrep-multimodal/getting-started.md): Semgrep Multimodal extends standard Semgrep capabilities by providing contextually aware AI-powered vulnerability detection and remediation suggestions.
- [Customize Semgrep Multimodal](https://docs.semgrep.dev/semgrep-multimodal/customize.md): You can customize Semgrep Multimodal by enabling and using the features detailed on this page.
- [Best practices for writing Memories](https://docs.semgrep.dev/semgrep-multimodal/best-practices-for-memories.md): This page covers various best practices for writing Memories.

### Semgrep Community Edition

- [Supported languages for Semgrep Community Edition (CE)](https://docs.semgrep.dev/semgrep-ce-languages.md): This document provides information about supported languages for Semgrep Code and Semgrep CE.
- [Semgrep Community Edition in CI](https://docs.semgrep.dev/deployment/oss-deployment.md): Semgrep Community Edition (CE) can be set up to run static application security testing (SAST) scans on repositories of any size.

#### Get started

- [Get started with Semgrep Community Edition](https://docs.semgrep.dev/getting-started/quickstart-ce.md): Semgrep Community Edition (CE) is an open source static analysis tool that can find insecure coding patterns and security vulnerabilities in source code. Semgrep CE encompasses a SAST scanning engine, community rules, and integrated development environment plugins.
- [Customize Semgrep Community Edition (CE) scans](https://docs.semgrep.dev/customize-semgrep-ce.md): This article shows you how to customize your local scans with Semgrep Community Edition (CE). Before proceeding with this article, ensure that you are familiar with [scanning a project using Semgrep CE](/getting-started/quickstart-ce).

#### About Semgrep CE

- [Semgrep Community Edition (CE) philosophy](https://docs.semgrep.dev/contributing/semgrep-philosophy-1.md)
- [Semgrep AppSec Platform versus Semgrep Community Edition](https://docs.semgrep.dev/semgrep-pro-vs-oss-1.md)
- [Compare Semgrep to Opengrep](https://docs.semgrep.dev/faq/comparisons/opengrep-1.md)

### References

- [Semgrepignore v2 reference](https://docs.semgrep.dev/semgrepignore-v2-reference.md)
- [CLI reference](https://docs.semgrep.dev/cli-reference.md)
- [Semgrep JSON and SARIF fields](https://docs.semgrep.dev/semgrep-appsec-platform/json-and-sarif.md): This reference provides Semgrep fields for JSON and SARIF output.

#### CI references

- [CI references](https://docs.semgrep.dev/category/ci-references-1.md)
- [Continuous integration (CI) environment variables](https://docs.semgrep.dev/semgrep-ci/ci-environment-variables-1.md)
- [Sample continuous integration (CI) configurations](https://docs.semgrep.dev/semgrep-ci/sample-ci-configs-1.md): This document provides sample configuration snippets to run Semgrep CI on various continuous integration (CI) providers.
- [Findings in CI](https://docs.semgrep.dev/semgrep-ci/findings-ci-1.md): When running any Semgrep product in CI, Semgrep is able to track the lifetime of an individual finding. When configured to perform a diff-aware scan, Semgrep only shows new findings relative to some specified baseline commit.
- [Packages in the Semgrep docker image](https://docs.semgrep.dev/semgrep-ci/packages-in-semgrep-docker-1.md)

#### Language reference

- [Language reference](https://docs.semgrep.dev/category/language-reference.md)
- [Language maturity levels](https://docs.semgrep.dev/references/language-maturity-levels.md)
- [Feature definitions](https://docs.semgrep.dev/references/feature-definitions.md)
- [Semantic detection in Java](https://docs.semgrep.dev/semgrep-code/java.md): This document explains how Semgrep detects true positives and reduces false positives in Java.

#### Glossaries

- [Glossaries](https://docs.semgrep.dev/category/glossaries-1.md)
- [Semgrep Code product terms](https://docs.semgrep.dev/semgrep-code/glossary.md): The terms and definitions provided here are specific to Semgrep Code.
- [Semgrep Supply Chain glossary](https://docs.semgrep.dev/semgrep-supply-chain/glossary.md): The terms and definitions provided here are specific to Semgrep Supply Chain.