Skip to main content
Developer exception requests is a feature that allows developers to request that findings identified by Semgrep be triaged as Ignored if they think it is safe to ignore, a false positive, or an acceptable risk.
After Semgrep scans your project, you can review your findings and request an exception to ignore a finding.For blocking findings, you must request and receive approval to ignore the finding. Once you receive approval from a Semgrep admin, you can re-scan the project to unblock your pull request (PR) or merge request (MR).For non-blocking findings, you can merge the PR or MR without an approved exception request from an admin. However, the finding’s status remains unchanged and is only changed to Ignored when a Semgrep admin approves the request.

​
Request an exception

To request an exception:

​
Respond to a PR or MR comment

When Semgrep identifies a finding in your PR or MR, it posts a comment that indicates whether the finding is blocking, provides a description of the issue, provides instructions on resolving the issue, and provides a link to the finding on the Semgrep AppSec Platform.To request an exception, reply to Semgrep’s comment using one of the following options:
  • /ignore <explanation of why the finding is safe to ignore>
  • /fp <explanation of why the finding is a false positive>
  • /ar <explanation of why the finding is an acceptable risk>

​
Triage a finding and submit a request in Semgrep AppSec Platform

  1. Log in to Semgrep AppSec Platform.
  2. Go to the Findings page for the product of interest: Code, Supply Chain, or Secrets.
  3. To triage a finding in the Group by Rule view:
    1. Find the rule used to generate the finding. Select the checkbox for the associated finding. Then, click Triage > Ignored.
    2. Select Ignore reason, and optionally, provide Comments to describe why you’re ignoring the finding.
    3. Click Request to ignore.
  4. To triage a finding in the No grouping view:
    1. Select the checkbox next to the finding you want to ignore, and click Triage > Ignored.
    2. Select Ignore reason, and optionally, provide Comments to describe why you’re ignoring the finding.
    3. Click Request to ignore.

​
Review responses to your requests

For requests initiated in a PR or MR comment: Once an admin has reviewed and responded to your request, Semgrep posts a follow-up comment to the existing PR or MR comment thread.If the admin has approved your request and the finding involved was a blocking finding, you can rescan your PR or MR to unblock it. The finding’s status in Semgrep AppSec Platform also changes to Ignored. If the finding was not a blocking finding, the status of the finding in Semgrep changes to Ignored.If your request is denied, the PR comment informs you of this. The finding’s status in Semgrep changes to To fix, indicating that you must address the finding before proceeding.For requests initiated in Semgrep AppSec Platform: View the finding to see its status. If your request is approved, the status updates to Ignored. Otherwise, the status is updated to To fix.