Semgrep Release Notes

Semgrep Guardian now supports Codex with the same capabilities as Claude Code using the fixed guardian-default ruleset, and saving xAI, OpenAI, Gemini, or Azure OpenAI no longer erases the stored API key. Agentic Workflows runs now last up to five hours, rotating a customer-owned GitHub App webhook secret updates existing webhooks, and new SCM connections require a hostname instead of an IP address.

Cursor Origin support is in public beta with Managed Scans and PR check comments, and AWS CodeArtifact support is in private beta for Supply Chain. Deployment tag API endpoints now require tag-specific permissions, double URL-decoding of repeated query parameters on v1 endpoints is fixed, and Autofix no longer treats HTTP 403 as write access for Azure DevOps and Bitbucket Data Center.

🌐 Semgrep AppSec Platform

Updates to Semgrep during the week of September 14-20, 2026.

Updates to Semgrep during the week of September 7-13, 2026.

Updates to Semgrep AppSec Platform, Code, Supply Chain, Multimodal, and Secrets. Key additions: OAuth reauthorization for ticketing integrations, read-only API tokens, webhook actions for remediation policies. Autofix now enabled for all Code customers. Supply Chain Autofix…

Developer exception requests now in public beta for blocking findings. Semgrep Registry asks for confirmation before adding rules. Multiple webhook actions per remediation policy. Read-only permission option for Agent and Web API tokens. Usage and Billing separated into tabs.…

Workflow issues column added to Projects page. GPT-5.6 Luna as default model for Semgrep Multimodal. Agentic Workflows now requires Semgrep Multimodal enabled. Organization-wide nosemgrep setting in public beta. Policies V1 and Ruleboard API endpoints return 410 Gone for…

Multiple Code findings can now be fixed in single Autofix PR/MR. Code Autofix toggle removed from Settings. Agentic Workflows issues available through experimental v2 API. Workflow jobs tab includes branch filter. Memories can be sorted by findings affected. Free-tier AI scan…

Agentic Workflows step logs use structured viewer with searchable and filterable fields. Agentic Workflows issues show file links from stored repository metadata. Public policies API vocabulary includes breaking_change and full_scan. Findings counts on Projects page include…

Semgrep Agentic Workflows now in public beta for multi-step AI-enabled detection pipelines. Webhook validation error messages include specific failure reasons. Project tag confirmation warnings added. License compliance can block only when all licenses blocked. Default Supply…

All Findings pages now show reason for ignored findings. Managed Scans cancelled when incident-response scan starts. Extraneous drawer removed when adding Slack message action. Settings > Integrations page reorganized. Git contributor information collection extended from 30 to…

Unified Policies now generally available for centralized rule and action management. Jira subtasks created for grouped findings. Project names must be unique and case-insensitive. Managed Scans cancelled when disabled. 0xdea community rules registry added. Pro C/C++ scans skip…

June 2026

The following updates were made to Semgrep in June 2026.

Updates to Semgrep in June 2026 across all products:

Project archiving from Project settings. Jira subtasks configuration in integration settings. Policies automations condition builder includes typeahead search. Remediation policies support vulnerability class conditions. Public API endpoints for detection and remediation…

May 2026

The following updates were made to Semgrep in May 2026.

April 2026

The following updates were made to Semgrep in April 2026.

Updates to Semgrep in May 2026:

September 2025

The following updates were made to Semgrep in September 2025.