Week of August 24, 2026
- Developer exception requests are in public beta: Security administrators can set a developer triage permission between no triage and full triage by adding Require exception requests to any policy. For blocking findings, an exception request must be approved before the finding is ignored and the developer is unblocked.
- Usage and Billing are separate Settings tabs: All users can view credit usage, and customers who bought one product through self-serve checkout can buy additional products.
Week of August 17, 2026
nosemgrepsetting is in public beta: Admins can enable or disablenosemgrepcomments for their organization and filter findings to see which findings were ignored through anosemgrepcomment.- Workflow issues on Projects: A Workflow issues column is now available on the Projects page. Select a count to open the Agentic Workflows issues for that project.
Week of August 10, 2026
- Fix multiple Code findings in one Autofix PR or MR: When several findings in the same file come from the same rule, Semgrep offers to open one Autofix pull request or merge request for the group.
- Agentic Workflows issues API: Issues created by Semgrep Agentic Workflows are now available through the experimental v2 API.
Week of August 3, 2026
- Unified Policies migration schedule: Semgrep will start migrating some organizations to Unified Policies on August 24, 2026, and will sunset the current version of Policies on November 1, 2026.
- Projects findings counts: Findings counts on the Projects page now include Reviewing and To fix findings, in addition to Open.
Week of July 27, 2026
- Semgrep Agentic Workflows is in public beta: Run multi-step AI-enabled detection pipelines from Semgrep AppSec Platform. See Get started with Semgrep Agentic Workflows.
- Supply Chain incident Slack notifications: Released a default Supply Chain incident notification policy to all Supply Chain customers using Unified Policies. You can also configure a Slack channel to be notified during an ongoing Supply Chain incident, including whether you might be affected based on your most recent SBOM.
- License compliance for multi-licensed packages: You can configure license compliance to block a dependency only when all of its licenses are blocked, instead of when any license is blocked.
Week of July 13, 2026
- Unified Policies is generally available: Choose the rules and rulesets used for Semgrep scans and define what happens after Semgrep identifies a finding, such as leaving PR or MR comments, blocking PRs or MRs, creating Jira tickets, or sending Slack notifications.
Week of July 6, 2026
- Archive projects in Semgrep: You can archive a project from Project settings. Projects archived in Semgrep appear on an Archived tab with an archived badge, alongside projects archived in your source code manager.
- Vulnerability class conditions: Remediation policy automations can now be scoped to a vulnerability class such as SQL Injection or Path Traversal.