Skip to main content
In the code, a Semgrep finding in CI is defined by a 4-tuple:
These states correspond to:
  1. rule ID: The rule’s ID within the Semgrep ecosystem.
  2. file path: The filesystem path where the finding occurred.
  3. syntactic context: The lines of code corresponding to the finding.
  4. index: An index into identical findings within a file. This is used to disambiguate findings if the same syntactic context occurs multiple times in the same file.

​
Semgrep Code findings

Semgrep AppSec Platform builds on CI findings to track status and provide additional context for managing findings within your organization. A finding can be one of four statuses in Semgrep AppSec Platform:
  • OPEN
  • PROVISIONALLY_IGNORED
  • REVIEWING
  • FIXING
  • IGNORED
  • FIXED

​
Finding status

You can manage finding status through triage in Semgrep AppSec Platform’s Findings page. The finding statuses are as follows:

​
Removed findings

Findings can also be removed. Semgrep considers a finding removed if it is not found in the most recent scan of the branch where Semgrep initially detected it due to any of the following conditions:
  • The rule that detected the finding isn’t enabled in the policy anymore.
  • The rule that detected the finding was updated in a way that it no longer detects the finding.
  • The file path where the finding appeared is no longer found. The file path was deleted, renamed, added to a .semgrepignore file, added to a .gitignore file, or added to the list of ignored paths in Semgrep AppSec Platform.
  • For GitHub organization accounts: the pull request or merge request where the finding was detected has been closed without merging.
Your removed findings do not count toward the fix rate or the number of findings. The removed findings also do not appear in Semgrep AppSec Platform.

​
Triage behavior across refs and branches

  • When you triage a finding as ignored, reviewing, fixing, or reopened, Semgrep always triages across other branches and Git references (refs).
  • At scan time, there’s automatic triaging that occurs in specific cases, and the behavior changes depending on the type of scan:
    • Full scans: if the current branch includes a finding that was
      • Previously introduced in another branch and
      • Triaged to a specific state
        Then the finding in the current branch is triaged to that same state.
    • Diff-aware scan: findings introduced in a diff-aware scan are not automatically triaged at scan time, even if there are other instances of that finding on branches that have been triaged.