Supported source code managers

Semgrep supports the following source code managers (SCM) and plans to varying degrees. Please review the information for your specific SCM and plan to see what Semgrep features are available to you.

Plan	Unsupported Semgrep features
Azure DevOps Cloud	Query console Auto PRs for Supply Chain findings
Azure DevOps Server	Semgrep Multimodal Semgrep Managed Scans Pull request comments Query console Diff-aware scans Sending findings to Semgrep AppSec Platform Default branch identification Auto PRs for Supply Chain findings Generic secrets (requires Semgrep Multimodal)
Bitbucket Cloud Free	Semgrep Multimodal† Semgrep Managed Scan† Query console Auto PRs for Supply Chain findings Generic secrets (requires Semgrep Multimodal)
Bitbucket Cloud Standard	Semgrep Multimodal† Semgrep Managed Scan† Query console Auto PRs for Supply Chain findings Generic secrets (requires Semgrep Multimodal)
Bitbucket Cloud Premium	Query console Auto PRs for Supply Chain findings
Bitbucket Data Center	Query console Diff-aware scans and triage through PR comments require Bitbucket Data Center version 8.8 or later. Auto PRs for Supply Chain findings
GitHub Free	-
GitHub Pro	-
GitHub Team	-
GitHub Enterprise Cloud	-
GitHub Enterprise Server	Auto PRs for Supply Chain findings
GitLab Free	Semgrep Managed Scans* Triage though MR comments* Query console Auto PRs for Supply Chain findings
GitLab Premium	Query console Auto PRs for Supply Chain findings
GitLab Ultimate	Query console Auto PRs for Supply Chain findings
GitLab Dedicated / Dedicated for Government	Query console Auto PRs for Supply Chain findings
GitLab Self-Managed Free	Semgrep Managed Scans* Query console Auto PRs for Supply Chain findings
GitLab Self-Managed Premium	Query console Auto PRs for Supply Chain findings
GitLab Self-Managed Ultimate	Query console Auto PRs for Supply Chain findings

†Semgrep Multimodal and Managed Scans require a workspace access token, which is only available to users with Bitbucket Cloud Premium.

*Semgrep Managed Scans and triage through MR comments require access to group webhooks, which is unavailable to GitLab Free users.

Access limitations

You may need to add Semgrep’s IP addresses to your ingress and egress allowlists, or you can use the Network Broker, if any of the following conditions apply:

• Your SCM offers security features that limit access to your resources
• Your SCM is behind a firewall or protected by network restrictions regarding access
• You are using a virtual private network (VPN)