Semgrep Analysis

SAST Risk Severity

Semgrep Cloud SAST findings receive a risk_severity property from post-ingestion analysis. Findings in archived GitHub repositories are assigned INFO; otherwise, the value follows the finding severity.

SCA Reachability Risk

Semgrep SCA findings receive a reachability_risk property based on severity, reachability, and the reachability check. Findings in archived repositories or findings confirmed as unreachable are assigned INFO.

Other combinations use the risk levels defined by SEMGREP_SCA_RISK_ANALYSIS, based on the likelihood and impact approach from NIST SP 800-30 Revision 1 and Semgrep reachability exposure guidance.