Skip to main content
Autofix creates a branch, applies the changes, and opens a draft pull request (PR) or merge request (MR). You remain in full control over reviewing and merging the PR or MR.
Autofix is different from Rule-defined fix and Semgrep Multimodal’s Suggested fix. These are separate features with different behaviors and use cases.

​
Prerequisites

To use Autofix, you must meet the following requirements:
  • Enable Semgrep Multimodal.
  • Accept Amazon Bedrock or Anthropic’s Claude models.
    • During beta, Semgrep Code does not respect AI model selection.
  • Have at least one connected repository with new or existing Semgrep Code findings.
  • Grant the SCM roles, scopes, and app permissions Autofix needs for your SCM. See SCM permissions for the Autofix row for your provider and Grant code access to configure your connection. For GitHub API and security review details, see Autofix permissions.
Autofix requires read and write access to your repositories on your SCM so Semgrep can push a branch and open a PR or MR.

​
Use Autofix

1
Log in to Semgrep AppSec Platform
2
Click Code to view all SAST findings.
3
Identify the finding you want to Autofix and click the hyperlink on the card to navigate to the finding’s Details page.
4
From the Fix drop-down, select Open Autofix PR.
5
You will see the following message:
Starting to generate Autofix PR. Semgrep is generating an Autofix PR for this finding. A new notification will appear here when the PR is ready.
6
In 2 to 10 minutes, Semgrep generates a proposed fix and opens a draft PR or MR in your SCM.
  • This action is recorded in the Activity section at the bottom of the finding’s Details page.
7
Click View Autofix PR in the FIX DETAILS section to review the newly created PR or MR.

​
PR or MR details

  • The pull or merge request is opened as a draft for Semgrep Code findings.
  • Semgrep provides an AI-generated description of the changes in the PR or MR.
  • On GitHub, the pull request is authored by the Semgrep GitHub App.
  • If your SCM account is connected to Semgrep, you are automatically mentioned in the PR or MR.

​
Findings with open PRs on Semgrep AppSec Platform

You can filter for findings with Autofix PRs directly from the Code page in Semgrep AppSec Platform. Click the To fix drop-down and select To fix to do so. This filter shows findings that have Autofix PRs. It may also include findings that were manually marked as To fix.

​
Create Autofix PR with remediation policies

You can automate Autofix PR creation by adding Create Autofix PR as an action in a remediation policy. When findings match the policy’s scope and conditions, Semgrep opens a PR or MR with the proposed fix.
1
Sign in to Semgrep AppSec Platform.
2
Go to Rules & Policies > Remediation, then click + Create automation.
3
Provide a Policy name and set the Scope to the projects where you want Autofix PRs created.
4
Under Conditions, add Branch type and set it to Primary branch only. Semgrep requires this condition to use the Create Autofix PR action.
5
Under Actions, select Create Autofix PR.
6
Click Create & Enable to save and activate the policy.

​
Control the number of PRs created

For best results, use Conditions to narrow which findings trigger Autofix PRs. Without additional filters, a policy can open many PRs at once. Consider adding conditions such as severity, reachability, or specific rules to limit the volume of PRs Semgrep creates.

​
Enable auto-merge through your SCM

Semgrep opens Autofix PRs for your team to review and merge. Auto-merge is not configured in Semgrep. If you want approved Autofix PRs to merge automatically after checks pass, enable auto-merge in your source code manager (SCM).
Configure auto-merge in GitHub, GitLab, Bitbucket, or Azure DevOps according to your team’s review requirements. For example, you may require passing status checks or a minimum number of approvals before a PR merges automatically.

​
Disable Autofix

If you use Semgrep Multimodal, Autofix is enabled by default. To adjust settings:
1
Sign in to Semgrep AppSec Platform
2
Navigate to Settings > General > Code
3
Set the Autofix toggle to enabled or disabled

​
How Autofix PRs are generated

Autofix generates a proposed change specifically for the PR workflow. This process uses the detected pattern and surrounding code context to produce the fix.

​
Use of remediation guidance

When Multimodal remediation guidance exists for a finding, the descriptive guidance is used to generate the code changes included in the PR.

​
How memories affect PR generation

At this time, Semgrep Memories do not directly influence Autofix PR generation. Memories may affect PRs indirectly through remediation guidance. If remediation guidance has been generated and includes information derived from memories, that guidance is passed into the PR generation process. However, memories themselves are not currently sent as direct input when generating the PR.