Features
Each column covers the following:- GitHub: Free, Pro, Team, and Enterprise Cloud, including Enterprise Cloud with data residency
- GitLab: Free, Premium, and Ultimate on GitLab.com
- GitLab Dedicated: includes GitLab Dedicated for Government
- GitLab Self-Managed: Free, Premium, and Ultimate
- Bitbucket Cloud: Free, Standard, and Premium
Minimum versions for self-hosted SCMs
Semgrep doesn’t support versions earlier than the minimum.Feature requirements by SCM
GitHub
- Code search isn’t available on GitHub Enterprise Cloud with data residency.
GitLab
- Semgrep Managed Scans and triage through MR comments require group webhooks, which aren’t available on GitLab Free.
GitLab Self-Managed
- Semgrep Managed Scans and triage through MR comments require group webhooks, which aren’t available on GitLab Free.
- Inline MR comments from Semgrep Agentic Workflows require GitLab 16.5 or later. GitLab 16.5 added the
unidiffoption, which gives Semgrep the file headers it needs to place inline comments. On older versions, workflow issues appear in the merge request summary comment instead.
Bitbucket Cloud
- Semgrep Multimodal, generic secrets, Managed Scans, and Autofix require a workspace access token, which is only available on Bitbucket Cloud Premium.
- Managed Scans and triage through PR comments also require workspace-level webhooks, which aren’t available on Bitbucket Cloud Free or Standard.
Cursor Origin
- Cursor Origin support is in beta. Feature parity with other SCMs is incomplete during the beta. See Cursor Origin Managed Scans.
Access limitations
You may need to add Semgrep’s IP addresses to your ingress and egress allowlists, or you can use the Network Broker, if any of the following conditions apply:- Your SCM offers security features that limit access to your resources
- Your SCM is behind a firewall or protected by network restrictions regarding access
- You are using a virtual private network (VPN)