> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tierity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Semgrep

> Pull SAST findings, secrets detection results, and supply chain issues from Semgrep into Tierity.

## Overview

Semgrep is a fast, open-source static analysis tool that finds bugs, vulnerabilities, and secrets in code. The Tierity Semgrep integration pulls scan findings from your Semgrep deployment into Tierity for triage and tracking.

## Prerequisites

* A [Semgrep](https://semgrep.dev) account (Team or Enterprise)
* A Semgrep API token with read access
* Manage access (or higher) in Tierity

## Setup

**1. Generate a Semgrep API token**

1. Log in to [semgrep.dev](https://semgrep.dev).
2. Go to **Settings → Tokens**.
3. Click **Create new token** with the `scans:read` scope.
4. Copy the token.

**2. Find your deployment slug**

Your deployment slug appears in the Semgrep dashboard URL:

```
https://semgrep.dev/orgs/<your-deployment-slug>/...
```

**3. Configure in Tierity**

1. Go to **Config → Integrations → Semgrep**.
2. Enter your **API Token** and **Deployment Slug**.
3. Click **Save & Test** to verify credentials.

**4. Configure per-repository sync settings**

After connecting, Tierity loads your repositories from Semgrep. For each repo you want to sync: toggle **Visible** and **Sync Enabled**, then click **Save**.

## What gets synced

| Data | Description |
| - | - |
| **SAST findings** | Code vulnerabilities with file path, line numbers, and column ranges |
| **Secrets findings** | Exposed credentials and API keys detected in code |
| **Supply chain findings** | Vulnerable dependencies |
| **Severity** | Critical, High, Medium, Low, Informational |
| **Rule metadata** | Rule ID, CWE mappings, OWASP category |

## Refreshing findings

To pull the latest findings: **Config → Integrations → Semgrep → Refresh Findings**.

## Disconnecting

**Config → Integrations → Semgrep → Disconnect**. Previously synced findings remain until manually deleted.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.