Reporting

Use the Reporting page in Semgrep AppSec Platform to review your security posture and trends over time. To see recommended actions and current work, go to Dashboard instead. Reporting helps you:

Evaluate your AppSec program, enabling you to know your current security risk.
Assess the deployment and adoption of secure guardrails to your organization.
Become aware of trends and opportunities that you can use to improve your security posture.
Quickly filter data granularly for all the charts on the page and view priority findings.
Review Semgrep Guardian and Semgrep Malware Firewall activity.
Export the information as a PDF report.

Reporting overview

The Reporting page is divided into several sections:

Section	Description
Reporting summary top bar	Sets the filters for the page. For details, see Filters and configuration.
Production backlog	Displays data about all the findings detected in your primary or default branch and helps you answer the following questions: - How is your security posture changing over time? - Is your backlog decreasing or increasing? - Is the team addressing findings faster than new findings are coming in?
Developer engagement	Displays data relevant to the deployment and adoption of secure guardrails. It helps address the following: - How many vulnerabilities did Semgrep prevent from entering production over time? - Are your developers adopting secure guardrails? - Of the issues shown to developers, are they being fixed, or are they being ignored?
Guardian reporting (private beta)	Displays developer adoption, scan activity, and findings for Semgrep Guardian and Semgrep Malware Firewall.
Most findings by project	Lists projects arranged by most open findings to least, grouped by product or severity. Helps answer the following: - Which of your projects have the most findings in a particular product area? - Which of your projects have the most findings for a particular severity?
Median open age	A graph showing the middle age of all Open findings, grouped by product or severity. Half of the open findings are older than this age, and half are newer. Helps you answer: - What is the amount of time a finding remains open, by product or by severity?

TIPUse the filters to quickly generate views for a single Semgrep product or all products.When viewing data for a single Semgrep product, you can’t group by product in Most findings by project and Median open age.

Export reports

To generate reports from the current view, click Reporting > Download.

Triage states

The following triage states are displayed:

Open
Ignored, including provisionally ignored
Fixed

Additional triage states, such as Fixing or Reviewing, are not displayed at this time.

Filters and configuration

Use the filters to gain a top-level view or zoom in to a single product, specific period of time, or other slice of data. Create quarterly overviews or recent incident statements for various AppSec stakeholders. Filters apply to every section of the page except Guardian, which uses only the time period filter. The following quick filters are visible on the page:

Time period
Semgrep product or type of scan (SAST, SCA, or Secrets)
Project (a repository or a subfolder of a monorepo)
Recommended priority toggle

INFO

By default, the Reporting page displays data for projects that members or managers have access to. Admins can view findings from all the projects in the organization. See the Teams documentation for more information.
It can take up to a day (24 hours) for the Reporting page to correctly update and remove findings if you have recently deleted a project.

To access all filters:

Click All filters to open the filter drawer.

Turn off the Recommended priority toggle.

This displays the following filters in the filter drawer:

Severity
Confidence
Reachability
Validation
Time period
Product
Project
Tags
Teams

Recommended priority

This refers to any finding that is Critical or High severity in addition to being:

High confidence - if the finding is from Semgrep Code.
Reachable - if the finding is from Semgrep Supply Chain.
Valid - if the finding is from Semgrep Secrets.

By default, Recommended priority filters are enabled. If you choose to turn off recommended priority filters, all findings are displayed.

Production backlog

This pane displays analytics related to findings detected in your primary or default branch. This typically means that the finding, usually a security issue, has made it to production environments.

Key metrics

Key metrics	Description
Total opened	Total number of findings set to Open during the time period. This includes new findings as well as re-opened findings that were previously in a different state.
Total fixed	Total number of Fixed findings during the time period that remained fixed until the end of the time period.
Total ignored	Total number of Ignored findings during the time period that remained ignored until the end of the time period. Ignored findings include those with a status of Provisionally ignored.
Total net new	The difference between the number of Open findings at the beginning of the time period and the end of the time period.

TIPA low or negative value for Total net new is ideal. It indicates that, within the period, more findings are being triaged or resolved than opened. This reduces the backlog of security issues.

Charts

Chart	Description
Open backlog	This tracks the total findings from each scan and displays them. Lower values are better. Hover over the chart to see a breakdown of findings by product for the selected time period.
Backlog activity	Displays the number of new, net new, fixed, and ignored, including provisionally ignored, findings. A greater Fixed value is better. Hover over the chart to see a breakdown of findings by triage state for that selected time period.

Developer engagement

This provides an overview of how secure guardrails in PR or MR comments are used in your organization, including how often Semgrep shows findings to developers, how the developers handle the findings, and how often Semgrep flags a finding as provisionally ignored. Other guardrail interfaces, such as the IDE or pre-commit, are not counted in this section.

Key metrics

Key metrics	Description
Findings shown to devs	Number of findings shown to developers in PR or MR comments (the numerator) against the total findings count (denominator). An upward or stable trend is better.
Findings fixed in development	Number of findings that were fixed before they could be detected in a default branch or production backlog (numerator) against the total findings count in the specified time period (denominator). An upward or stable trend is better. Hover over the chart to see a breakdown of findings by triage state for that selected time period.

Charts

Chart	Description
Findings surfaced	Percent of new findings shown to developers over the specified time period. An upward or stable trend is better.
PR/MR activity	This chart displays a breakdown of the status of findings shown to developers; whether they were ignored, provisionally ignored, fixed, or remained open. A greater Fixed value is better. Hover over the chart to see a breakdown of findings by triage state for that selected time period.

Guardian reporting

Semgrep Guardian reporting and Semgrep Malware Firewall are in private beta.

The Guardian section displays the following data for the time period you select:

Developer adoption
Scan activity
Findings from scans of code that AI coding agents generate
Malware Firewall scans that blocked a package

The section includes only the products enabled for your organization. Other filters on the page don’t apply to it. To see more data for an item in the section, click View details. For more information, see Semgrep Guardian and Semgrep Malware Firewall.

Most findings by project

A table listing projects from most open findings to least, grouped by product or severity. Lower values are better.

TIPIt is recommended to prioritize triage and remediation for the top projects listed in this table, especially if the priority filters are enabled.

Median open age

A chart displaying the median open age of a finding in days over the specified time period. Lower is better. For a finding to be remediated, it must have any of the following statuses:

Fixed
Ignored, including provisionally ignored

Get started

Set up and deploy scans

Scan and triage

Semgrep Multimodal

Semgrep Community Edition

References

Reporting overview

Export reports

Triage states

Filters and configuration

Recommended priority

Production backlog

Key metrics

Charts

Developer engagement

Key metrics

Charts

Guardian reporting

Most findings by project

Median open age

​Reporting overview

​Export reports

​Triage states

​Filters and configuration

​Recommended priority

​Production backlog

​Key metrics

​Charts

​Developer engagement

​Key metrics

​Charts

​Guardian reporting

​Most findings by project

​Median open age

Reporting overview

Export reports

Triage states

Filters and configuration

Recommended priority

Production backlog

Key metrics

Charts

Developer engagement

Key metrics

Charts

Guardian reporting

Most findings by project

Median open age