Week of October 5, 2026

🌐 Semgrep AppSec Platform

Rotating the webhook secret for a customer-owned GitHub App now also updates the secret on existing webhooks, so pull request workflows continue to trigger after rotation. If your webhooks already have a stale secret, go to Settings > Source code managers and click Rotate webhook secret. This applies to GitHub Cloud and GitHub Enterprise.
When you connect a self-hosted source code manager, Semgrep now shows the reason for a connection failure. If Connect fails for an expected reason, Semgrep keeps the saved connection so you can correct it and retry.
When you add a new source code manager connection, Semgrep now requires a hostname in the base URL instead of an IP address. This change doesn’t affect existing connections.
The findings API (GET /api/v1/deployments/{deploymentSlug}/findings) now returns click_to_fix_prs and click_to_fix_failures on Semgrep Code and AI-powered detection findings for every deployment. click_to_fix_prs lists pull requests created by Autofix, and click_to_fix_failures lists failed Autofix attempts. Previously, these fields returned empty lists unless the deployment was in the Autofix beta.

Fixed issues where pull requests or merge requests could remain blocked beyond the fail-open deadline for Semgrep Managed Scans. The overhauled fail-open system now reliably updates PRs and MRs on time, even if scans are delayed or the source code manager is temporarily unavailable. The fail-open deadline is 10 minutes by default, and you can change it.
Fixed an issue where changing a GitHub pull request’s base branch didn’t trigger a new diff-aware scan unless you also pushed a commit. Other changes, like editing the title or description, still don’t trigger a scan.

When Supply Chain Autofix opens a pull request, the finding moves from Open or Reviewing to To fix, matching Autofix for Semgrep Code. If the finding already has a different triage state, it keeps that state. If the pull request fails, the finding stays in the triage state it already had.

The AI provider settings now offer Automatic and Manual selection. In Automatic mode, Semgrep manages the list of AI providers, which includes Amazon Bedrock, Cloudflare Workers AI, and OpenAI, and updates it when Semgrep adds a provider. When you turn on Semgrep Multimodal, Semgrep uses Automatic mode.
Only organization admins can use the API to create, change, delete, or view Agentic Workflows schedules, or to trigger workflow runs, including a single run, a workflow pack, and a bulk run. This behavior matches Semgrep AppSec Platform, which already limits these pages to admins.
The Total credits used column on the workflow scheduling page now counts runs from every trigger, including runs started by pull requests, instead of only scheduled runs.

Fixed an issue where Semgrep Agentic Workflows runs exceeding two hours were marked as failed before completion, preventing their results from appearing in Agentic Workflows issues. Runs can now take up to five hours.
Fixed an issue where saving xAI, OpenAI, or Google Gemini without re-entering your API key erased the stored key. Saving Azure OpenAI failed in the same case. Semgrep now keeps the stored key. If you change an Azure OpenAI or xAI endpoint to a different host, re-enter the key. Bringing your own API key is available only to Semgrep Enterprise and to users who already had their own API key.
Fixed an issue where Agentic Workflows runs failed to start on Cursor Origin repositories if the Semgrep installation didn’t have write access or used a different API host. Workflows that only read code now run with read-only access.

Fixed an issue where Autotriage of Generic secrets failed repeatedly for an issue that already had more than one triage result.

Semgrep Guardian now supports Codex, with the same capabilities as Claude Code. It scans with Semgrep Code, Supply Chain, and Secrets on a Semgrep-hosted server, so you do not need the Semgrep CLI. Codex uses the fixed guardian-default ruleset, not your Policies. On Windows, Guardian requires Windows Subsystem for Linux (WSL). See Set up Semgrep Guardian for Codex.