Skip to main content

SemGrep

Semgrep is a fast, open-source static application security testing (SAST) tool and code analysis platform designed for finding bugs, detecting security vulnerabilities, and enforcing code standards across codebases. It serves as a lightweight semantic code search and analysis engine that enables developers, security engineers, and DevSecOps teams to scan source code for patterns, anti-patterns, security issues, and policy violations.

CategoryVulnerability management
DirectionQuery source
Sign-inAPI Token
Query languagesSQLite
Websitehttps://semgrep.dev/

Before you start​

Huntbase signs in to SemGrep with API Token. Create the credential in SemGrep first, then keep it to hand for the Connect step.

  1. Log in to Semgrep AppSec Platform and go to Settings › Tokens.
  2. Create a new API token and select Web API under Token scopes.
  3. Copy the token.

Permissions:

  • Web API token scope
Watch out for
  • The Web API requires a Team or Enterprise tier account.
  • A token with only the Agent (CI) scope returns 404 errors from the Web API. Edit the token and add the Web API scope.

For the vendor's own instructions, see Semgrep Web API token scope article.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect SemGrep​

  1. Go to Connections and click New connection, or click New connection on the SemGrep product page.
  2. On Product, pick SemGrep and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your SemGrep lives:

FieldRequiredNotes
Base URLNohttps://semgrep.dev/api/v1.

Credentials​

The only Method is API Token. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
API TokenYesSecret — not shown again after you save it.

Query it​

Once connected, SemGrep can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
SQLiteSQL across this source and every other connected source.

Next steps​