Skip to main content

​
Overview

Semgrep is a fast, open-source static analysis tool that finds bugs, vulnerabilities, and secrets in code. The Pwnbook Semgrep integration pulls scan findings from your Semgrep deployment into Pwnbook for triage and tracking.

​
Prerequisites

  • A Semgrep account (Team or Enterprise)
  • A Semgrep API token with read access
  • Admin or Owner access in Pwnbook

​
Setup

1

Generate a Semgrep API token

  1. Log in to semgrep.dev.
  2. Go to Settings → Tokens.
  3. Click Create new token with the scans:read scope.
  4. Copy the token.
2

Find your deployment slug

Your deployment slug appears in the Semgrep dashboard URL:
3

Configure in Pwnbook

  1. Go to Organization Settings → Marketplace → Semgrep.
  2. Enter your API Token and Deployment Slug.
  3. Click Save & Test to verify credentials.
4

Configure per-repository sync settings

After connecting, Pwnbook loads your repositories from Semgrep. For each repo you want to sync: toggle Visible and Sync Enabled, then click Save.

​
What gets synced

​
Refreshing findings

To pull the latest findings: Organization Settings → Integrations → Semgrep → Refresh Findings.

​
Disconnecting

Organization Settings → Marketplace → Semgrep → Disconnect. Previously synced findings remain until manually deleted.