Autofix is different from Rule-defined fix and Semgrep Multimodal’s Suggested fix. These are separate features with different behaviors and use cases.
Open an Autofix PR or MR
1
Log in to Semgrep AppSec Platform
2
Click Code to view all SAST findings.
3
Identify the finding you want to Autofix and click the hyperlink on the card to navigate to the finding’s Details page.
4
From the Fix drop-down, select Open Autofix PR.
- If Semgrep Multimodal is not enabled, Open Autofix PR does not appear in the drop-down. See When Autofix is available.
- If your SCM connection is missing write access (for example, Contents: Write on GitHub), Semgrep shows a modal with setup instructions instead of starting the Autofix PR. See When Autofix is available.
5
You will see the following message:
Starting to generate Autofix PR. Semgrep is generating an Autofix PR for this finding. A new notification will appear here when the PR is ready.
6
In 2 to 10 minutes, Semgrep generates a proposed fix and opens a draft PR or MR in your SCM.
- This action is recorded in the Activity section at the bottom of the finding’s Details page.
7
Click View Autofix PR in the FIX DETAILS section to review the newly created PR or MR.
Fix multiple findings in one Autofix PR
If multiple Semgrep Code findings are in the same file and were detected by the same rule, Semgrep can open a single Autofix PR or MR that remediates the group. When you select Open Autofix PR for one of those findings, Semgrep gives you the option to include the other matching findings from that file in the same PR or MR.Findings with open PRs on Semgrep AppSec Platform
You can filter for findings with Autofix PRs directly from the Code page in Semgrep AppSec Platform. Click the To fix drop-down and select To fix to do so. This filter shows findings that have Autofix PRs. It may also include findings that were manually marked as To fix.When Autofix is available
To use Autofix for Semgrep Code findings, you must meet the following requirements:Project requirements
- Enable Semgrep Multimodal.
- Accept Amazon Bedrock, including Anthropic Claude models. Semgrep calls Amazon Bedrock on your behalf. You do not need to give Semgrep access to your AWS account.
- Semgrep Code does not respect AI model selection.
- Have at least one connected repository with new or existing Semgrep Code findings.
Repository requirements
- Semgrep needs read and write access to the repository so it can push a branch and open a PR or MR. See Grant read and write access.
Environment-specific requirements
- If Semgrep connects to your SCM through the Semgrep Network Broker, upgrade to Network Broker 0.45.2 or later and set
allowCodeAccesstotruefor that SCM. This setting defaults tofalse. Older broker versions return a 403 allowlist error. See Use Semgrep Network Broker with Autofix.
What the PR or MR contains
Always included
- The pull or merge request is opened as a draft for Semgrep Code findings.
- Semgrep provides an AI-generated description of the changes in the PR or MR.
- On GitHub, the pull request is authored by the Semgrep GitHub App.
- If your SCM account is connected to Semgrep, you are automatically mentioned in the PR or MR.
Included when remediation guidance is available
When Multimodal remediation guidance exists for a finding, the descriptive guidance is used to generate the code changes included in the PR.How Autofix PRs are generated
Autofix generates a proposed change specifically for the PR workflow. This process uses the detected pattern and surrounding code context to produce the fix.How memories affect PR generation
At this time, Semgrep Memories do not directly influence Autofix PR generation. Memories may affect PRs indirectly through remediation guidance. If remediation guidance has been generated and includes information derived from memories, that guidance is passed into the PR generation process. However, memories themselves are not currently sent as direct input when generating the PR.Troubleshooting
- If Semgrep Multimodal is not enabled, Open Autofix PR does not appear in the drop-down. See project requirements.
- If your SCM connection is missing write access (for example, Contents: Write on GitHub), Semgrep shows a modal with setup instructions instead of starting the Autofix PR. See repository requirements and environment-specific requirements.