Skip to main content

Autofix

To receive AI-generated code changes for Semgrep Code findings, enable Autofix. Autofix opens a pull request or merge request with proposed fixes.

Suggested fix

Enable Multimodal’s Suggested fix to see an explanation on how to fix true positives. To enable Suggested fix, follow these steps:
1
Sign in to Semgrep AppSec Platform, and navigate to Settings > General > Code.
2
Click the Suggested fix toggle to enable this feature.
3
Optional: Select a confidence level in the drop-down box. This value determines the quality of Suggested fix. For example, if you select lower confidence, Semgrep Multimodal suggests a fix even when the suggestion quality is lower.
TIPSemgrep recommends setting a low confidence level since even imperfect suggestions may be useful starting points for triage and remediation.

Weekly priority emails

Weekly priority emails allows organization admins to receive information on top backlog tasks according to Multimodal. If this feature is not enabled for your deployment, you can do so as follows:
1
Sign in to Semgrep AppSec Platform, and navigate to Settings > General > Global.
2
Click the Weekly priority emails if it is not yet enabled.

Noise filtering

Multimodal is over 95% accurate in categorizing Semgrep Code findings as false positives, so you can minimize the number of findings shown by enabling Noise filter for Code PR/MR comments. To do so:
1
Sign in to Semgrep AppSec Platform, and navigate to Settings > General > Code.
2
Click the Noise filter for Code PR/MR comments if it is not yet enabled.
3
Select whether you want to enable PR or MR comments for false positive findings:
  1. Don’t leave a PR/MR comment: Hide Semgrep’s comments on findings that are likely to be false positives. These findings are available for security review on the Code > Pre-production backlog page. Comments still appear for rules in Block mode.
  2. Include a notification in the PR/MR comment: Show developers likely false positive findings in PR/MR comments, but include a note explaining why Multimodal thinks the finding may be safe to ignore.
Findings filtered out by Multimodal can be reviewed at any time in Semgrep by going to the Code > Pre-production backlog page. Semgrep also allows you to agree with the filtering to close the finding or disagree to reopen.

Add Memories

Memories allow admins to tailor Multimodal’s remediation guidance to their organization’s standards and defaults. You can provide feedback by adding custom instructions whenever Multimodal provides a Suggested fix. Semgrep Agentic Workflows also reads Memories when it triages issues. See Triage with memories. Memories are enabled by default for all organizations with Multimodal or Agentic Workflows enabled.

Add a memory

1
Sign in to Semgrep AppSec Platform.
2
Navigate to Rules & Policies > Memories.
3
Click New Memory.
4
In Memory, enter your preferred remediation approach and secure default.
5
Select the Projects and the Rules to which the memory should be applied.
  1. Choose All projects or any specific project.
  2. Choose All rules, or search for and select a specific rule or a general vulnerability class. Selecting a vulnerability class means the memory applies to all rules with that vulnerability class.
  3. To scope a memory to AI-powered detection or Agentic Workflows, select a vulnerability class under AI Detection.
6
Click Add memory to save your changes and proceed.
See Best practices for writing Memories for information on writing effective memories.

Add a memory based on Multimodal’s Suggested fix

To add a memory based on a Suggested fix presented by Multimodal:
1
Identify the specific instance of Multimodal’s Suggested fix that you want to modify. This can be found on the finding details page or in the PR or MR comment.
  • If Multimodal used existing memories to generate the guidance, you can click on Referenced X memories while writing this guidance to see the memories used.
2
Click Customize fix to open an input box, and enter your preferred remediation approaches and secure defaults for the project. Your suggestion can be as general as “Use X library to sanitize SQL queries.”
3
Click Save and regenerate.
4
Multimodal regenerates the Suggested fix to reflect the instructions you provided.
Memories are scoped by project and by rule or vulnerability class. A saved memory only affects future guidance for findings in the projects and rules or vulnerability classes that you selected.

Add memory during triage and receive memory suggestions from Multimodal

When you identify findings that are safe to ignore and provide reasoning for your actions, Semgrep Multimodal can use this triage feedback to suggest memories. It can start suggesting memories from the very first triage feedback it receives, or it may suggest memories from multiple pieces of feedback, depending on the level of detail in the feedback and the finding’s unique context. If Multimodal creates a new memory, it will use the memory to assess if similar findings are safe to ignore and hide from developers. To triage and create a memory (Semgrep automatically attempts to create a memory during triage if possible):
1
Identify the specific finding you want to modify, and open up its finding details page.
2
Click Ignore, select an Ignore reason, and provide Comments on why you’re triaging the finding as Ignore.
3
Click Ignore. Multimodal attempts to create a memory using the information you provide. If Multimodal successfully creates a memory for you, you’ll see a link to the list of memories for your organization in the dialog that appears.
Permissions:
  • Automatic generation of memories: if you are an admin user, Multimodal tries to generate active memories from your triage feedback.
  • If you are a non-admin user, such as a manager, Multimodal creates a suggested memory that needs an admin to activate it.

View and edit memories

1
Sign in to Semgrep AppSec Platform.
2
Navigate to Rules & Policies > Memories.
There are two tabs on the Memories page for your review:
  • The Active tab displays a list of memories that Multimodal and Agentic Workflows are actively using to triage findings and issues
  • The Suggested tab displays a list of memories Multimodal has generated based on past triage actions and developer feedback. For each suggestion, you can:
    • Activate the suggested memory to inform Multimodal’s advice on current and future findings
    • Edit the memory, then activate it
    • Delete the suggested memory
Only users assigned the admin role in Semgrep can activate suggested memories.

Remove memories

1
Sign in to Semgrep AppSec Platform.
2
Navigate to Rules & Policies > Memories.
3
Identify the memory you would like to delete, then click the icon to remove the memory.

Select your AI provider

Semgrep evaluates available models from multiple providers and selects the most performant option for each Multimodal feature, based on the providers enabled for your organization. Autofix requires Amazon Bedrock. If Bedrock is disabled, Autofix does not run. To choose how Semgrep selects providers:
1
Sign in to Semgrep AppSec Platform and navigate to Settings > Global.
2
Click the icon next to AI providers.
3
Select Automatic or Manual, then click Save.

Automatic

Automatic is the default. Semgrep manages the AI providers and API keys under zero data retention agreements. Semgrep keeps the provider list up to date. It currently includes:
  • OpenAI
  • Amazon Bedrock
  • Cloudflare Workers AI
Organizations on the minimal data retention policy get OpenAI and Amazon Bedrock only.

Manual

Manual lets you choose your own AI providers and API keys. It requires a Semgrep subscription plan that includes bring your own key (BYOK). Organizations that already use Manual can keep using it. In Manual, select the providers you want. Each feature uses the enabled providers it supports. Cloudflare Workers AI can’t be the only enabled provider. The following providers can use your own API keys or accounts. Anthropic is available only with your own API key.

OpenAI API with your own key

Under OpenAI account, select Your key, then paste your OpenAI API key.By switching from Semgrep’s key to your key, note that you lose access to the following:
  • Semgrep’s fine-tuned models that can increase the quality of results.
  • Semgrep’s Zero Data Retention agreement that prevents OpenAI from saving input or output data.
  • Semgrep paying for the cost of your AI usage.

Agentic Workflows and AI-powered detection on your own providers

Agentic Workflows and AI-powered detection scans can run on OpenAI, Anthropic, Google Gemini, xAI, and Microsoft Foundry with your own key. They don’t use Amazon Bedrock with your own AWS account or Cloudflare Workers AI. When you enable at least one provider with your own key or account, Agentic Workflows and AI-powered detection scans send all of their model requests to your providers. They don’t fall back to Semgrep-managed OpenAI or Amazon Bedrock, even if you enable those too. If a step needs a model that none of your providers serves, that step fails. If you enable more than one provider with your own key or account, each step uses the first model in its list of preferred models that one of your providers serves. For example, a step that asks for a fast model uses gpt-5.6-luna if you enable OpenAI with your own key, even if you also enable Anthropic. You can’t choose which provider a step uses. A single run can send requests to several of your providers, and each provider bills you for its own usage. Your provider bills you directly for model usage on your key or account, and Agentic Workflows runs and AI-powered detection scans still consume AI credits. See AI credits with your own providers.