Semgrep

F Semgrep AppSec Platform

CI scans (semgrep ci) and the Semgrep Web API accept only static tokens such as SEMGREP_APP_TOKEN. No OIDC or CI token exchange exists. Tokens never expire, cannot be created through the API, show no last use and are not in GitHub's partner program, though scopes such as Agent (CI) and Read-only limit them. Into your repos it uses a GitHub App, but GitLab, Bitbucket and Azure DevOps want access tokens.

Docs: docs.semgrep.dev · Checked 2026-10-22 · source YAML · dispute via PR

Inbound Frequires Team or Enterprise (Web API access)

How a workload running anywhere authenticates to this product.

Static deployment token sent as Authorization: Bearer. CI jobs read it from SEMGREP_APP_TOKEN (Agent (CI) scope); the Web API takes a Web API or Read-only scoped API token. No OIDC, CI workload identity or token-exchange path is documented.

docs.semgrep.dev checked 2026-10-22
“An access token is a secure credential used to authorize requests to Semgrep AppSec Platform or the Semgrep API without a username and password.”
docs.semgrep.dev checked 2026-10-22
“API tokens can be created by admins and are used for calls to the Semgrep API and to set up third-party integrations.”
docs.semgrep.dev checked 2026-10-22
“These tokens authenticate agents running automated scans.”
semgrep.dev checked 2026-10-22
“Set SEMGREP_APP_TOKEN to send findings to Semgrep AppSec Platform and use rules from the Policies page.”
docs.semgrep.dev checked 2026-10-22
“Store it as an environment variable or secret in your CI provider.”
docs.semgrep.dev checked 2026-10-22
“SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}”
docs.semgrep.dev checked 2026-10-22
“The API supports authentication with an API token with the "Web API" permission, without limited scopes of access.”
semgrep.dev checked 2026-10-22
“The API requires a Team or Enterprise tier account, with the subsequent API token provisioned in your settings.”
docs.semgrep.dev checked 2026-10-22
“This article walks you through single-sign on (SSO) configuration.”

Graded on the weakest path a workload must use: both `semgrep ci` and the v1/v2 Web API take only a static bearer token. The v1 and v2 OpenAPI specs declare SemgrepWebToken plus two user-session JWT schemes (SemgrepJWT, SemgrepAdminJWT) used by the web app, not federation. The only OIDC in the docs is SSO for human login (OpenID Connect and SAML). The GitHub Actions sample reads SEMGREP_APP_TOKEN from repository secrets, and during onboarding the Semgrep GitHub App writes that token into repo secrets for you; no id-token / OIDC exchange is offered. Managed Scans avoid a CI token entirely by having Semgrep pull code over the SCM connection (outbound, below), but anything you automate from your own CI or scripts still needs a static token. CI scanning works on the free tier; Web API access needs Team or Enterprise.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

GitHub (Cloud and Enterprise) connects through a Semgrep GitHub App your org installs, Cursor Origin through Semgrep's public app, Jira Cloud through app consent, and AWS CodeArtifact by assuming your IAM role with an External ID; GitLab, Bitbucket and Azure DevOps connections want a customer-created access token, and private registries and Wiz want static credentials.

docs.semgrep.dev checked 2026-10-22
“You can connect to GitHub with Semgrep's GitHub App, or with a personal access token.”
docs.semgrep.dev checked 2026-10-22
“During the connection process, your organization creates a private GitHub App from Semgrep's template, named”
docs.semgrep.dev checked 2026-10-22
“You do not need to create an app or provide credentials.”
docs.semgrep.dev checked 2026-10-22
“Its trust policy allows the Semgrep role ARN to assume it, but only with your External ID.”
docs.semgrep.dev checked 2026-10-22
“Follow the on-screen instructions to grant Semgrep the necessary permissions and set up the integration.”
docs.semgrep.dev checked 2026-10-22
“You must provide a GitLab group access token or personal access token to Semgrep.”
docs.semgrep.dev checked 2026-10-22
“Your **Access token**. Semgrep requires a [workspace-level access token](https://support.atlassian.com/bitbucket-cloud/docs/create-a-workspace-access-token/), which is only available on **Bitbucket Cloud Premium**.”
docs.semgrep.dev checked 2026-10-22
“Set the token name, permissions, and expiry.”
docs.semgrep.dev checked 2026-10-22
“During setup and configuration, you must provide a personal access token generated by the account. This token must be authorized with **Full access**.”
docs.semgrep.dev checked 2026-10-22
“Generates a key pair server-side and returns the public certificate for the customer to upload to their Entra app registration.”
docs.semgrep.dev checked 2026-10-22
“**Username and password**: provide the required **Username** and **Password**.”
docs.semgrep.dev checked 2026-10-22
“You can obtain the **API Endpoint URL** and the **Authentication URL** from Wiz in [Tenant Info](https://app.wiz.io/tenant-info/general), while Wiz provides the **Client ID** and **Client Secret** when you set up a service account.”
docs.semgrep.dev checked 2026-10-22
“Returns the Managed Scans VPC Bootstrap CloudFormation template in JSON format for setting up cross-account infrastructure.”

Checked: GitHub Cloud (default is a private "Semgrep Code - YOUR_ORG_NAME" app created from Semgrep's template, older orgs have the public semgrep-app; nothing pasted by the customer; a GitHub PAT is an alternative); GitHub Enterprise Cloud with data residency and GitHub Enterprise Server (app registered from Semgrep's flow on your instance); Cursor Origin (public Semgrep app, keyless; a private app means handing Semgrep its private key); Jira Cloud (Atlassian app consent, keyless); AWS CodeArtifact for Supply Chain dependency resolution (IAM role with External ID, two-hour tokens; private beta); Managed Scans in your AWS VPC (CloudFormation cross-account roles, private beta, documented only in the v2 API spec). Static: GitLab Cloud and Self-Managed (group or personal access token with api scope), Bitbucket Cloud (workspace access token, Premium only), Bitbucket Data Center (HTTP access token), Azure DevOps (PAT with Full access during setup, narrowed afterwards), private package registries (username/password or API token), Wiz (service-account client ID and secret), plus Bitbucket PR-comment tokens. The v2 API spec also lists an Azure DevOps Entra service principal install where Semgrep generates the key pair and you upload only the public certificate; that would be keyless from your side, but it is not in the user docs, so it is not counted. The docs do give least-privilege scopes per feature for the token-based SCMs. Semgrep Network Broker is a WireGuard tunnel you run; its private key stays with you. B: keyless for GitHub and AWS, static tokens for the other SCMs.

Hygiene for any static credential the product still issues

✗ Expiry enforceable	The create-token steps offer scope and name only, with no expiry field, and no org policy for a maximum lifetime is documented. A token minted today works until someone revokes it. docs.semgrep.dev checked 2026-10-22 “However, they remain valid until manually revoked, even if the creator is no longer associated with the deployment.”
✗ Rotation via API	Tokens are created and revoked in the web app (Settings > Tokens). The only API surface is an Experimental bulk DELETE on /api/tokens/v1/deployments/{id}/tokens that removes every CLI or API token of a given role at once; neither v1 nor v2 has a create-token or revoke-one endpoint, so rotation cannot be automated without a browser. docs.semgrep.dev checked 2026-10-22 “Delete all tokens matching the given filters” docs.semgrep.dev checked 2026-10-22 “Only CLI and API tokens can be bulk-deleted through this RPC, so” docs.semgrep.dev checked 2026-10-22 “Go to [Settings > Tokens > API tokens](https://semgrep.dev/orgs/-/settings/tokens/api).”
✓ Scoped keys	Passes on permission scoping: each token gets one of Agent (CI), Web API, Member or Read-only, and does not inherit its creator's access (it outlives the creator). There is no per-project or per-repository scoping, a token covers the whole deployment, and a Web API token has full read and write access. docs.semgrep.dev checked 2026-10-22 “Scopes are mutually exclusive.” docs.semgrep.dev checked 2026-10-22 “Tokens with the Agent (CI) scope can connect scans with the platform to request rules, send findings, and post PR/MR comments, but they cannot use the Web API.” docs.semgrep.dev checked 2026-10-22 “It cannot perform write or mutate operations.”
✗ Last-used visible	The token pages offer search and a filter by scope or service; no last-used time is documented on the token pages, the docs or either OpenAPI spec. docs.semgrep.dev checked 2026-10-22 “Each token type has its own page that lists all existing tokens of that type.”
✗ Leak revocation	Semgrep does not appear in GitHub's supported secret scanning patterns table, so a leaked SEMGREP_APP_TOKEN pushed to a public repo is not reported to Semgrep for revocation. docs.github.com checked 2026-10-22

Notes

One card for the hosted Semgrep AppSec Platform (Code, Supply Chain, Secrets, Managed Scans). The open-source Semgrep CE CLI needs no credential for local scans; Semgrep Guardian (IDE and agent plugins) signs developers in through browser OAuth or `semgrep login` and is a human path, not graded. Only one of five hygiene checks passes, so inbound is F. Token expiry with an enforceable maximum, plus create/revoke API endpoints, would lift it to D; accepting GitHub Actions or GitLab CI OIDC for `semgrep ci` would remove the most widely copied static token and move inbound to B or A. Outbound reaches A if GitLab, Bitbucket and Azure DevOps get app-based connections (the Entra service-principal install in the v2 spec is a start).

Badge

[![wif.tax grade](https://wif.tax/badge/semgrep-appsec-platform.svg)](https://wif.tax/p/semgrep-appsec-platform/)