Skip to main content
The Semgrep Slack app enables Semgrep AppSec Platform to notify you of new findings after every scan. By receiving notifications within your Slack workspace, developers and security engineers can see findings without switching environments. This can lessen the friction between detecting a finding, triaging it, and resolving it. You can select the channels in your Slack workspace that receive finding notifications. You can also choose to receive notifications only for certain repositories (projects) or Rule Modes. Semgrep Code supports Policy-based filters for notifications. For example, you can choose to receive notifications only for findings generated by rules from the Blocking Rule Mode.

​
Install the Semgrep Slack App

PREREQUISITES
  • You must be a Slack Workspace Owner to set up the Semgrep Slack app.
  • Single-tenant Semgrep AppSec Platform: Reach out to your Technical Account Manager (TAM) to ensure your instance has been configured for the Semgrep Slack app.
To install the Semgrep Slack app, follow these steps:
1
In Semgrep AppSec Platform, go to Settings > Integrations.
2
On the Integrations page, click Add (or Setup First Integration if this is your first integration), and then select Slack.
3
Click Allow.

​
Set up notifications for findings in Slack

​
Code and Supply Chain

To set up or subscribe to notifications for findings in your Slack workspace, perform the following steps:
1
In your Slack workspace, find or create a channel for Semgrep notifications.
  • If you use a private channel for notifications, first invite the Semgrep app by entering the command /invite @Semgrep in the channel. If the app is not invited to a private channel, it cannot send notifications there.
2
In the selected Slack channel, enter the following command: /semgrep_subscribe.
3
Optional: Enter the name of a specific project after /semgrep_subscribe to receive findings for that specific project only. The project must be entered as it is shown in Semgrep AppSec Platform, typically:
/semgrep_subscribe ACCOUNT_NAME/REPOSITORY_NAME
4
Choose an organization in the list under Select target organization. The dialog box expands with additional options.
5
Optional: Set up additional filters.
  • For users receiving both Semgrep Code and Semgrep Supply Chain findings: Use Target scan type to choose whether to receive notifications for Semgrep Code, Semgrep Supply Chain, or both.
  • For Semgrep Code users only: In the Selected Policies field, choose the specific policies you want to receive findings for. By default, all policies are selected, including Monitor policy, which may result in a higher volume of notifications.
6
Click Subscribe. If you did not specify a project after /semgrep_subscribe, the channel is subscribed to findings from all your projects in Semgrep AppSec Platform.
7
Optional: To set up Slack notifications for additional workspaces, repeat steps 1 to 6. The Semgrep Slack integration is set up on a per-workspace basis.
You have successfully set up notifications for Semgrep findings. The Semgrep Slack app reports new findings after every scan but does not report findings that were previously discovered.
SUGGESTED WORKFLOWIn your Slack workspace, create separate channels for either policies, repositories (projects), or types of findings depending on your business or development need. This ensures that developers receive only findings that are relevant to them.

​
Secrets

To set up or subscribe to notifications for findings in your Slack workspace, perform the following steps:
1
In your Slack workspace, find or create a channel for Semgrep notifications.
  • If you use a private channel for notifications, first invite the Semgrep app by entering the command /invite @Semgrep in the channel. If the app is not invited to a private channel, it cannot send notifications there.
2
In the selected Slack channel, enter the following command: /semgrep_subscribe_secrets.
3
Choose an organization in the list under Select target organization.
4
Click Subscribe. You can now configure Semgrep Secrets notifications for this channel.
5
This channel is now ready to receive Semgrep Secrets notifications. To configure when notifications are sent, create a Semgrep Secrets policy.
6
Optional: To set up Slack notifications for additional workspaces, repeat steps 1 to The Semgrep Slack integration is set up on a per-workspace basis.

​
Remove notifications for findings in Slack

NOTEThis operation removes or unsubscribes a channel from notifications. To uninstall the Semgrep Slack App, refer to Uninstall the Semgrep Slack App.

​
Code and Supply Chain

To remove or unsubscribe to notifications:
1
In Slack, enter the channel that you want to unsubscribe from Semgrep findings.
2
Type /semgrep_unsubscribe.
3
Select the target organization to unsubscribe from.
4
Click Unsubscribe.
You have unsubscribed from Semgrep finding notifications for that particular channel.

​
Secrets

To remove notifications:
1
From the Secrets policies tab, click the three-dot(…) button > Edit policy for the policies that trigger notifications in this channel.
2
Unselect the desired channels from the policy.
3
Click Save changes.
To unsubscribe a channel:
1
In Slack, enter the channel that you want to unsubscribe from Semgrep Secrets findings.
2
Type /semgrep_unsubscribe_secrets.
3
Select the target organization to unsubscribe from.
4
Click Unsubscribe.
Unsubscribing removes this channel from your list of available channels for all Semgrep Secrets policies. You will no longer be able to create policies using this channel, and it will be removed from existing policies, stopping all notifications to this channel.

​
Notification and alert de-duplication

Notifications are sent only the first time a given finding is detected. When running a diff-aware scan, Semgrep doesn’t notify you when a pull request has a finding that existed on the base branch already, even if that line is moved or re-indented. Semgrep also tracks notifications that have already been sent, so subsequent scans of the same changes in a pull request won’t result in duplicate notifications.
NOTESee Findings in CI for more information about how Semgrep tracks a finding through its lifetime.

​
Uninstall the Semgrep Slack App

CAUTIONThis removes all Semgrep notifications in all channels in your Slack workspace.
1
In Semgrep AppSec Platform, go to Settings > Integrations.
2
On the Integrations page, find the Slack integration you want to remove.
3
Expand the Channels receiving Semgrep notifications section and review the channels receiving notifications.
4
In the related channels in your Slack workspace, use the /semgrep_unsubscribe command to unsubscribe from those notifications.
5
After completing this step for all channels, click Remove integration > Remove.

​
Troubleshooting

​
Not receiving any findings

The following list describes possible ways to troubleshoot findings not appearing in your Slack workspace:
  • Check if you have successfully set up your notifications.
  • Check if your most recent scan has findings to send.
  • Check your filters.
  • Check if the channel is private. You must add the Semgrep Slack App to any private channel to subscribe to notifications in that channel.

​
Check notifications

To check that your notifications are set up, you can review notifications in two places:
  • On the Integrations page, locate your Slack integration and expand Channels receiving Semgrep notifications.
  • In your Slack workspace, click Semgrep under Apps in the Slack sidebar and review the channels under Notifications are being sent to the following channels.
    • To send a test notification to a channel in this list, click the three-dot menu > Send Test Notification.

​
Check your filters

If you have set up any filter, such as filtering for a specific policy or project, all conditions of that filter must be present for the notification to be sent. Review your filters by following the steps in Changing Slack notification settings.

​
Permissions not up-to-date

You may receive a message from Semgrep Slack app stating that your token does not have up-to-date permissions. Clicking the link provided in the message to update the permissions typically resolves this issue. However, if after updating the token, you still receive the same message, perform the following steps to revoke and refresh your access token:
1
In your Slack workspace, click Semgrep under Apps in the Slack sidebar.
2
Click Uninstall. This revokes your token.
3
Go to Semgrep AppSec Platform > Settings > Integrations.
4
Find the Slack entry for the workspace you revoked in step 2 and click Refresh Token.
5
Follow the steps in the authentication flow to complete the token refresh.
You have refreshed your access token and updated your permissions.

​
Fixing dispatch_failed error

There are many possible causes for this error. Try the following fixes:
  • Re-enter your last command or operation after a few minutes.
  • Uninstall, and then reinstall your Semgrep Slack integration.

​
Fixing operation_timeout error

This error occasionally appears due to connection or service issues. To fix this issue, retry your last command or operation after a few minutes.

​
Slack permissions

The following table describes the purpose for each permission required to use the Semgrep Slack app.

​
Additional resources