Skip to main content
Semgrep’s AI-powered detection combines the precision of static analysis with the contextual reasoning of large language models (LLMs). With AI-powered detection, you can automatically identify complex business logic flaws, such as insecure direct object references (IDORs) and broken authorization. AI-powered detection is part of Semgrep Multimodal, which uses artificial intelligence (AI) to scan code, triage findings, and provide remediation guidance. This page covers the kinds of issues AI-powered detection is designed to uncover, known limitations, and practical considerations such as billing and data privacy. For step-by-step instructions on enabling and running an AI-powered scan, see Scan with AI-powered detection.

​
Detection and scope

​
IDORs and other business logic flaws

A business logic flaw is any weakness in an application’s design or workflow that makes its legitimate features vulnerable to malicious use. Semgrep’s AI-powered detection focuses on authorization flow gaps that fall outside standard vulnerability categories:
  • IDOR and ownership gaps: accessing another user’s resource when ownership or tenant checks are missing, misplaced, or only client-side.
  • Order and sequence mistakes: state changes or token resets happening after sensitive reads/writes, or actions allowed in the wrong state.
  • Workflow abuse, or OWASP logic manipulation: skipping required steps, like shipping before checkout or refunds without a completed purchase.
Traditional Semgrep SAST can be configured to catch IDORs. However, because this requires understanding how the app in question handles authorization and database access, it is difficult to write generic rules that detect IDORs across all software applications. With Semgrep’s AI-powered detection, it is now possible to find IDORs and other business logic bugs without the need for extensive custom rule development.

​
Determinism of AI-powered detection findings

AI-powered detection findings are inherently non-deterministic. Because AI scans rely on probabilistic reasoning, repeated scans may not always produce identical results. However, Semgrep’s scanning engine helps make them more reliable. As with any automated security finding, you must review scan results carefully.

​
Setup, billing, and integrations

​
SCM support and AI providers

AI-powered detection builds on Semgrep’s existing integration framework, such as GitHub, GitLab, and Bitbucket. AI-powered detection uses Semgrep-managed OpenAI or Amazon Bedrock, whichever your organization has enabled in its AI provider settings. It doesn’t use providers that run on your own API key or Cloudflare Workers AI. If you don’t enable either OpenAI or Amazon Bedrock, AI-powered scans can’t run.

​
Credits required for AI actions

See Usage and billing for information about credits required for AI actions.

​
Data privacy and finding severity

The data privacy policy is similar to that described in Data privacy and legal considerations, with a few exceptions. Currently, all AI findings are assigned the same severity, which is high, and don’t have other attributes like confidence.

​
Known bugs and limitations

Here are some known issues: Scan limitations:
  • Only full scans are supported.
Findings limitations:
  • AI findings are not included in the Reporting/Dashboard.
  • Custom rules are not supported for AI-powered detection.

​
Troubleshooting

For help with AI-powered detection, contact your organization’s Semgrep account manager or Semgrep support.