Before you configureConfirm organizational readiness using the Pre-deployment checklist, which covers permission details and includes links to setup guides.
Permissions
The following tables list SCM roles and token or app scopes required for each Semgrep feature. Unless noted otherwise, pull request (PR) or merge request (MR) refers to a proposed set of code changes in your SCM. See Configure for setup guides.- Azure DevOps Cloud
- Bitbucket Cloud
- GitHub Cloud
- GitLab Cloud
| Feature | Role | Scopes | Configure |
|---|---|---|---|
| PR comments |
|
| Azure PR comments |
| Managed Scans |
|
| Azure Managed Scans |
| Code access | User who can update the SCM connection token | Connection PAT scopes:
| Grant code access |
| Autofix |
| Connection PAT scopes:
| Autofix |
GitHub App permissions
Semgrep AppSec Platform requests different GitHub App permissions depending on when you grant access.Permissions when signing in with GitHub
Semgrep AppSec Platform requests the following standard permissions set by GitHub when you first sign in. However, not all permissions are used by Semgrep AppSec Platform.Click to review how Semgrep AppSec Platform uses permissions when signing in.
Click to review how Semgrep AppSec Platform uses permissions when signing in.
Verify your GitHub identity
Enables Semgrep AppSec Platform to read your GitHub profile data, such as your username.Know which resources you can access
Semgrep does not use or access any resources when first logging in. However, you can choose to share resources at a later point to add repositories into Semgrep AppSec Platform.Act on your behalf
Enables Semgrep AppSec Platform to perform certain tasks only on resources that you choose to share with Semgrep AppSec Platform. Semgrep AppSec Platform never uses this permission and never performs any actions on your behalf, even after you have installed
Enables Semgrep AppSec Platform to read your GitHub profile data, such as your username.Know which resources you can access
Semgrep does not use or access any resources when first logging in. However, you can choose to share resources at a later point to add repositories into Semgrep AppSec Platform.Act on your behalf
Enables Semgrep AppSec Platform to perform certain tasks only on resources that you choose to share with Semgrep AppSec Platform. Semgrep AppSec Platform never uses this permission and never performs any actions on your behalf, even after you have installed
semgrep-app. For more information, see What does ‘Act on your behalf’ mean? and GitHub Apps acting on your behalf in GitHub documentation.Permissions when adding members or repositories
The public GitHub integration app is calledsemgrep-app. This app integrates Semgrep into user-selected GitHub repositories.
Click to review how Semgrep AppSec Platform uses permissions when adding members or repositories.
Click to review how Semgrep AppSec Platform uses permissions when adding members or repositories.
Reading metadata of the repositories you select
Enables Semgrep AppSec Platform to list repository names on the project setup page.Reading the list of organization members
Enables Semgrep AppSec Platform to determine who can manage your Semgrep organization based on your GitHub organization’s members list.Reading and writing pull requests
Enables Semgrep AppSec Platform to comment about findings on PRs. Read permissions allow Semgrep AppSec Platform to automatically remove findings when the PR that introduced them is closed without merging.Reading and writing actions
Enables Semgrep AppSec Platform to cancel stuck jobs, rerun jobs, pull logs from jobs, and perform on-demand scanning.Reading GitHub Checks
Facilitates debugging of Semgrep AppSec Platform when configured out of GitHub Actions.Reading and writing security events
Enables integration with GitHub Advanced Security (for example, to show Semgrep results).Reading and writing secrets
Enables the automatic adding of the Semgrep AppSec Platform Token to your repository secrets when onboarding projects. Note: Semgrep cannot read the values of your existing or future secrets (only the names).Reading and writing 2 files
Enables Semgrep AppSec Platform to configure itself to run in CI by writing to
Enables Semgrep AppSec Platform to configure itself to run in CI by writing to
Enables Semgrep AppSec Platform to list repository names on the project setup page.Reading the list of organization members
Enables Semgrep AppSec Platform to determine who can manage your Semgrep organization based on your GitHub organization’s members list.Reading and writing pull requests
Enables Semgrep AppSec Platform to comment about findings on PRs. Read permissions allow Semgrep AppSec Platform to automatically remove findings when the PR that introduced them is closed without merging.Reading and writing actions
Enables Semgrep AppSec Platform to cancel stuck jobs, rerun jobs, pull logs from jobs, and perform on-demand scanning.Reading GitHub Checks
Facilitates debugging of Semgrep AppSec Platform when configured out of GitHub Actions.Reading and writing security events
Enables integration with GitHub Advanced Security (for example, to show Semgrep results).Reading and writing secrets
Enables the automatic adding of the Semgrep AppSec Platform Token to your repository secrets when onboarding projects. Note: Semgrep cannot read the values of your existing or future secrets (only the names).Reading and writing 2 files
Enables Semgrep AppSec Platform to configure itself to run in CI by writing to
.github/workflows/semgrep.yml and .semgrepignore files.Reading and writing workflowsEnables Semgrep AppSec Platform to configure itself to run in CI by writing to
.github/workflows/semgrep.yml. GitHub allows writing to files within .github/workflows/ directory only if this permission is granted along with “Writing a single file.”Permissions for Managed Scans and AI features
You can create a private GitHub app, which follows the naming convention Semgrep Code - YOUR_ORG_NAME. This private app is used for:- Semgrep Managed Scans
- Semgrep Multimodal and other AI-assisted features
- Semgrep Code Autofix
Managed Scans and Multimodal require read access to your code. Autofix also requires write access and permission to open PRs.
Click to review how Semgrep AppSec Platform uses permissions for Managed Scans and AI features.
Click to review how Semgrep AppSec Platform uses permissions for Managed Scans and AI features.
Reading metadata of the repositories you select
Lets Semgrep list their names on the project setup page.Reading the list of organization members
Lets Semgrep determine who can manage your Semgrep organization based on your GitHub organization’s members list.Writing (and reading) pull requests
Lets Semgrep comment about findings on PRs.Writing (and reading) actions
Allows Semgrep AppSec Platform to cancel stuck jobs, rerun jobs, pull logs from jobs, and perform on-demand scanning.Reading checks
Facilitates debugging of Semgrep AppSec Platform when configured out of GitHub Actions.Writing (and reading) security events
Enables integration with GitHub Advanced Security (for example, to show Semgrep results).Writing (and reading) secrets
Enables automatic adding of the Semgrep AppSec Platform Token to your repository secrets when onboarding projects. Note: Semgrep cannot read the values of your existing or future secrets (only the names).Writing (and reading) 2 files
Lets Semgrep configure itself to run in CI by writing to
Lets Semgrep configure itself to run in CI by writing to
Allows Semgrep Multimodal to fetch source code files on-demand to construct AI prompts.
Lets Semgrep list their names on the project setup page.Reading the list of organization members
Lets Semgrep determine who can manage your Semgrep organization based on your GitHub organization’s members list.Writing (and reading) pull requests
Lets Semgrep comment about findings on PRs.Writing (and reading) actions
Allows Semgrep AppSec Platform to cancel stuck jobs, rerun jobs, pull logs from jobs, and perform on-demand scanning.Reading checks
Facilitates debugging of Semgrep AppSec Platform when configured out of GitHub Actions.Writing (and reading) security events
Enables integration with GitHub Advanced Security (for example, to show Semgrep results).Writing (and reading) secrets
Enables automatic adding of the Semgrep AppSec Platform Token to your repository secrets when onboarding projects. Note: Semgrep cannot read the values of your existing or future secrets (only the names).Writing (and reading) 2 files
Lets Semgrep configure itself to run in CI by writing to
.github/workflows/semgrep.yml and .semgrepignore.Writing (and reading) workflowsLets Semgrep configure itself to run in CI by writing to
.github/workflows/semgrep.yml. GitHub allows writing to files within .github/workflows/ only if this permission is granted along with “Writing a single file.”Read source code of the repositories you selectAllows Semgrep Multimodal to fetch source code files on-demand to construct AI prompts.
Autofix permissions
Semgrep Code Autofix creates a branch with AI-generated changes and opens a draft PR or MR. Autofix requires Semgrep Multimodal, code read and write access on your SCM connection, and permission to create PRs or MRs. For SCM and plan availability, see Supported source code managers. For roles, scopes, and setup links, see the Autofix row for each provider in Permissions table.GitHub App permissions and API usage
Autofix uses your private Semgrep GitHub App with the permissions below. Use this section for security reviews, such as determining which GitHub operations require Contents: Read and write). See Grant code access to configure Contents: Read and write under Repository permissions > Contents on the private app.Repository permissions
| GitHub App permission | Why Autofix needs it |
|---|---|
| Contents: Read | Clone the repository using git+https (shallow, single-branch) so Semgrep can analyze the code and generate a fix. |
| Contents: Write | Push the Autofix branch back to the repository using git+https. |
| Metadata: Read | Read repository metadata, including the default branch, using GET /repos/{owner}/{repo}. |
| Pull requests: Write | Open a draft PR using POST /repos/{owner}/{repo}/pulls. |
How repository contents are accessed
Semgrep does not read or write file contents through the API’scontents endpoints (GET or PUT /repos/{owner}/{repo}/contents/{path}). Autofix reads and writes code only through the Git transport layer (clone and push), which still requires the GitHub Contents permissions above.