Source code manager permissions

Reference for source code manager permissions required by Semgrep features

Use this page to see what Semgrep needs from your source code manager (SCM): roles, token scopes, and GitHub App permissions for each feature. It is the canonical permissions reference.

Before you configure

Confirm organizational readiness using the Pre-deployment checklist, which covers permission details and includes links to setup guides.

Permissions

The following tables list SCM roles and token or app scopes required for each Semgrep feature. Unless noted otherwise, pull request (PR) or merge request (MR) refers to a proposed set of code changes in your SCM. The Configure column links to setup guides for each feature.

Azure DevOps Cloud

Feature	Role	Scopes	Configure
PR comments	Owner Project Collection Administrator Required for triage through PR comments.	Full access during setup/triage-webhook enablement After configuration: Project and Team: Read & write Pull Request Threads: Read & write	Azure PR comments
Managed Scans	Owner Project Collection Administrator	Full access on the PAT during setup Code: Read Code: Status Member Entitlement Management: Read Project and Team: Read & write Pull Request Threads: Read & write	Azure Managed Scans
Code access	User who can update the SCM connection token	Connection PAT scopes: Code: Read Code: Write	Grant code access
Autofix	Owner Project Collection Administrator	Connection PAT scopes: Code: Read Code: Write Project and Team: Read & write Pull Request Threads: Read & write	Autofix

Bitbucket Cloud

Feature	Role	Scopes	Configure
PR comments (Cloud)	User who can create workspace or repository variables. Workspace path requires Bitbucket Cloud Premium.	Workspace access token: Pull requests (read and write) Repository access token: Pull requests (read and write)	Bitbucket Cloud PR comments
Triage through PR comments (Cloud)	Product Admin. Requires Bitbucket Cloud Premium and a workspace access token.	webhook (read and write) repository (read and write) pullrequest (read and write) project (admin) account (read)	Bitbucket Cloud PR comments
Managed Scans (Cloud)	Product Admin	webhook (read and write) repository (read and write) pullrequest (read and write) project (admin) account (read)	Bitbucket Managed Scans
Managed Scans (Data Center)	Project Admin	HTTP access token with Project admin permissions	Bitbucket Managed Scans
Code access	User who can update the SCM connection token	Connection token scopes (colon notation): Cloud: repository:read pullrequest:read repository:write pullrequest:write Data Center: repository:read repository:write	Grant code access
Autofix (Cloud)	Product Admin. Requires Bitbucket Cloud Premium and a workspace access token.	repository (read and write) pullrequest (read and write)	Autofix
Autofix (Data Center)	Project Admin	HTTP access token with Project admin permissions and repository write access	Autofix

GitHub Cloud

Semgrep recommends connecting GitHub with a private Semgrep GitHub App. That is the default install path in Semgrep AppSec Platform. Some organizations instead use a personal access token (PAT). The table below covers the GitHub App path. For PAT roles and scopes, see GitHub personal access tokens.

Feature	Role	Scopes	Configure
Sign in and connect repositories	Org member who can install GitHub Apps on the organization	Private Semgrep GitHub App installation. See GitHub App permissions.	Connect a source code manager Create an account
Create CI jobs in bulk	Org member who can install GitHub Apps	Same as the private Semgrep GitHub App permissions for repository onboarding	Connect a source code manager
PR comments	Org member who can configure the Semgrep GitHub App on target repositories	actions (read and write) pull requests (read and write) secrets (read and write) security events (read and write) workflows (read and write)	GitHub PR comments
Managed Scans and AI-assisted features	Org member who can install GitHub Apps	Private Semgrep GitHub App with Contents: Read and permissions listed in Private GitHub App permissions	GitHub Managed Scans Semgrep Multimodal
Autofix	Org member who can install GitHub Apps	Private Semgrep GitHub App repository permissions: Contents: Read Contents: Write Metadata: Read Pull requests: Write See Autofix permissions and API usage.	Autofix Grant code access

GitLab Cloud

Feature	Role	Scopes	Configure
Sign in	GitLab user authorizing Semgrep	openid email profile api	Connect a source code manager
MR comments	Owner Admin on the GitLab group	api on the group access token	GitLab MR comments
Managed Scans and AI-assisted features	Maintainer Owner Admin during onboarding (can downgrade to Developer after setup)	api on group or personal access token read_repository for code access	GitLab Managed Scans Semgrep Multimodal
Code access	User who can update the SCM connection token	Connection token scopes: read_repository write_repository	Grant code access
Autofix	Maintainer Owner Admin during onboarding (can downgrade to Developer after setup)	Connection token scopes: api read_repository write_repository	Autofix

GitHub permissions

Semgrep recommends connecting GitHub with a GitHub App. Some organizations use a personal access token (PAT) instead. Use the tabs below for the method that applies to you.

GitHub App (recommended)

Public and private Semgrep GitHub Apps

New GitHub connections install a single private Semgrep GitHub App. Older organizations may still have the public semgrep-app from an earlier install path. You can uninstall the public app if it is no longer needed.

App	Typical name	What it is for
Private (default)	Semgrep Code - YOUR_ORG_NAME	Connecting your organization, listing repositories and members, PR comments, CI onboarding, and code access for Managed Scans, Semgrep Multimodal, and Autofix. Your organization creates and installs this app.
Public (older installs)	semgrep-app	Sign-in, connecting your organization, listing repositories and members, PR comments, and CI onboarding such as writing workflow files.

The sections below describe the permissions each app can request.

Permissions when signing in with GitHub

Semgrep AppSec Platform requests the following standard permissions set by GitHub when you first sign in. However, not all permissions are used by Semgrep AppSec Platform.

Click to review how Semgrep AppSec Platform uses permissions when signing in.

Verify your GitHub identity
Enables Semgrep AppSec Platform to read your GitHub profile data, such as your username.

Know which resources you can access
Semgrep does not use or access any resources when first logging in. However, you can choose to share resources at a later point to add repositories into Semgrep AppSec Platform.

Act on your behalf
Enables Semgrep AppSec Platform to perform certain tasks only on resources that you choose to share with Semgrep AppSec Platform. Semgrep AppSec Platform never uses this permission and never performs any actions on your behalf, even after you have installed semgrep-app. For more information, see What does ‘Act on your behalf’ mean? and GitHub Apps acting on your behalf in GitHub documentation.

Public GitHub App permissions

The public GitHub integration app is called semgrep-app. This app integrates Semgrep into user-selected GitHub repositories.

Click to review how Semgrep AppSec Platform uses public GitHub App permissions.

Reading metadata of the repositories you select
Enables Semgrep AppSec Platform to list repository names on the project setup page.

Reading the list of organization members
Enables Semgrep AppSec Platform to determine who can manage your Semgrep organization based on your GitHub organization’s members list.

Reading and writing pull requests
Enables Semgrep AppSec Platform to comment about findings on PRs. Read permissions allow Semgrep AppSec Platform to automatically remove findings when the PR that introduced them is closed without merging.

Reading and writing actions
Enables Semgrep AppSec Platform to cancel stuck jobs, rerun jobs, pull logs from jobs, and perform on-demand scanning.

Reading GitHub Checks
Facilitates debugging of Semgrep AppSec Platform when configured out of GitHub Actions.

Reading and writing security events
Enables integration with GitHub Advanced Security (for example, to show Semgrep results).

Reading and writing secrets
Enables the automatic adding of the Semgrep AppSec Platform Token to your repository secrets when onboarding projects. Note: Semgrep cannot read the values of your existing or future secrets (only the names).

Reading and writing 2 files
Enables Semgrep AppSec Platform to configure itself to run in CI by writing to .github/workflows/semgrep.yml and .semgrepignore files.

Reading and writing workflows
Enables Semgrep AppSec Platform to configure itself to run in CI by writing to .github/workflows/semgrep.yml. GitHub allows writing to files within .github/workflows/ directory only if this permission is granted along with “Writing a single file.”

Private GitHub App permissions

During the connection process, your organization creates a private GitHub App from Semgrep’s template, named Semgrep Code - YOUR_ORG_NAME. That app provides repository Contents access and related permissions for:

• Semgrep Managed Scans
• Semgrep Multimodal and other AI-assisted features
• Semgrep Code Autofix

Managed Scans and Multimodal need Contents: Read. Autofix needs Contents: Read and write and Pull requests: Write. For roles and scopes by feature, see the GitHub Cloud rows in Permissions. To grant or update Contents access, see Grant code access.

Click to review how Semgrep AppSec Platform uses private GitHub App permissions.

Reading metadata of the repositories you select
Lets Semgrep list their names on the project setup page.

Reading the list of organization members
Lets Semgrep determine who can manage your Semgrep organization based on your GitHub organization’s members list.

Writing (and reading) pull requests
Lets Semgrep comment about findings on PRs.

Writing (and reading) actions
Allows Semgrep AppSec Platform to cancel stuck jobs, rerun jobs, pull logs from jobs, and perform on-demand scanning.

Reading checks
Facilitates debugging of Semgrep AppSec Platform when configured out of GitHub Actions.

Writing (and reading) security events
Enables integration with GitHub Advanced Security (for example, to show Semgrep results).

Writing (and reading) secrets
Enables automatic adding of the Semgrep AppSec Platform Token to your repository secrets when onboarding projects. Note: Semgrep cannot read the values of your existing or future secrets (only the names).

Writing (and reading) 2 files
Lets Semgrep configure itself to run in CI by writing to .github/workflows/semgrep.yml and .semgrepignore.

Writing (and reading) workflows
Lets Semgrep configure itself to run in CI by writing to .github/workflows/semgrep.yml. GitHub allows writing to files within .github/workflows/ only if this permission is granted along with “Writing a single file.”

Read source code of the repositories you select
Allows Semgrep Multimodal to fetch source code files on-demand to construct AI prompts.

Autofix permissions and API usage

Autofix uses your private Semgrep GitHub App with the permissions below. Use this section for security reviews of Autofix on GitHub, such as determining which GitHub operations require Contents: Read and write.

Repository permissions

GitHub App permission	Why Autofix needs it
Contents: Read	Clone the repository over HTTPS using Git (shallow, single-branch) so Semgrep can analyze the code and generate a fix.
Contents: Write	Push the Autofix branch back to the repository over HTTPS using Git.
Metadata: Read	Read repository metadata, including the default branch, using GET /repos/{owner}/{repo}.
Pull requests: Write	Open a draft PR using POST /repos/{owner}/{repo}/pulls.

How repository contents are accessed

Semgrep Autofix reads and writes code only through the Git transport layer (clone and push), not through the API contents endpoints (GET or PUT /repos/{owner}/{repo}/contents/{path}). Git operations still require the GitHub Contents permissions above.

Personal access tokens

Use a personal access token (PAT) when your organization connects GitHub to Semgrep with a token instead of a GitHub App. Semgrep recommends a fine-grained PAT. Classic PATs remain supported as well.

A PAT can only grant access that the creating GitHub user already has. Use a machine user when possible. That user must be a member of the target organization, or a collaborator on the selected repositories. For Autofix, the user must be able to push branches and open pull requests on those repositories.

When you save a token or click Test on Settings > Source code managers, Semgrep validates that the PAT can access the connected organization. That check uses the same minimum scopes as code read access. It does not require additional scopes beyond those listed for Connect or Test SCM connection and Code access below.

Feature	Role	Fine-grained scopes (recommended)	Classic scopes	Configure
Connect or Test SCM connection	Org member or collaborator who can create a PAT for the target org or repositories	Resource owner: the GitHub organization Semgrep connects to Repository access: all or selected repositories Semgrep uses Metadata: Read. GitHub includes this automatically when you grant any repository permission.	repo for private repositories public_repo if the connection only needs public repositories If the organization uses SAML SSO, authorize the token for that organization after you create it.	Connect a source code manager Grant code access
Code access, Managed Scans, and AI-assisted features	Same as above; user must be able to read the target repositories	All Connect or Test requirements Contents: Read	Same as Connect or Test: repo or public_repo. Classic repo includes content read.	Grant code access Semgrep Managed Scans Semgrep Multimodal
Autofix	Same as above; user must be able to push branches and open PRs on the target repositories	All Code access requirements Contents: Read and write Pull requests: Read and write	repo, which includes content write and pull request write. public_repo is not enough for private repositories.	Autofix Grant code access

Next steps

• Grant code access: configure code read or write access on an SCM connection
• Connect a source code manager: connect GitHub, GitLab, Bitbucket, or Azure DevOps
• Pre-deployment checklist: organizational readiness before setup
• Autofix: enable and use Autofix
• Semgrep Multimodal: enable Multimodal and related AI-assisted features
• GitHub Managed Scans: install the Semgrep GitHub App for Managed Scans