> ## Documentation Index
> Fetch the complete documentation index at: https://semgrep-ee9d73d8-k80kent-malware-firewall-tweaks.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Source code manager permissions

> Reference for source code manager permissions required by Semgrep features

Use this page to see **what** Semgrep needs from your source code manager (SCM): roles, token scopes, and GitHub App permissions for each feature. It is the canonical permissions reference.

<Note>
  **Before you configure**

  Confirm organizational readiness using the [Pre-deployment checklist](/deployment/checklist), which covers permission details and includes links to setup guides.
</Note>

<h2 id="permissions">
  Permissions
</h2>

The following tables list **SCM roles** and **token or app scopes** required for each Semgrep feature. Unless noted otherwise, **pull request (PR)** or **merge request (MR)** refers to a proposed set of code changes in your SCM. The **Configure** column links to setup guides for each feature.

<Tabs>
  <Tab title="Azure DevOps Cloud">
    | Feature       | Role                                                                                                              | Scopes                                                                                                                                                                                                                                    | Configure                                                                               |
    | :------------ | :---------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------- |
    | PR comments   | <ul><li>**Owner**</li><li>**Project Collection Administrator**</li></ul> Required for triage through PR comments. | <ul><li>**Full access** during setup/triage-webhook enablement</li><li>After configuration:<ul><li>`Project and Team: Read & write`</li><li>`Pull Request Threads: Read & write`</li></ul></li></ul>                                      | [Azure PR comments](/semgrep-appsec-platform/azure-pr-comments)                         |
    | Managed Scans | <ul><li>**Owner**</li><li>**Project Collection Administrator**</li></ul>                                          | <ul><li>**Full access** on the PAT during setup</li><li>`Code: Read`</li><li>`Code: Status`</li><li>`Member Entitlement Management: Read`</li><li>`Project and Team: Read & write`</li><li>`Pull Request Threads: Read & write`</li></ul> | [Azure Managed Scans](/deployment/managed-scanning/azure#prerequisites-and-permissions) |
    | Code access   | User who can update the SCM connection token                                                                      | Connection PAT scopes: <ul><li>`Code: Read`</li><li>`Code: Write`</li></ul>                                                                                                                                                               | [Grant code access](/semgrep-appsec-platform/scm-code-access)                           |
    | Autofix       | <ul><li>**Owner**</li><li>**Project Collection Administrator**</li></ul>                                          | Connection PAT scopes: <ul><li>`Code: Read`</li><li>`Code: Write`</li><li>`Project and Team: Read & write`</li><li>`Pull Request Threads: Read & write`</li></ul>                                                                         | [Autofix](/semgrep-code/triage-remediation/autofix)                                     |
  </Tab>

  <Tab title="Bitbucket Cloud">
    | Feature                            | Role                                                                                                    | Scopes                                                                                                                                                                                                                                                                     | Configure                                                                               |
    | :--------------------------------- | :------------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------- |
    | PR comments (Cloud)                | User who can create workspace or repository variables. Workspace path requires Bitbucket Cloud Premium. | <ul><li>Workspace access token: `Pull requests (read and write)`</li><li>Repository access token: `Pull requests (read and write)`</li></ul>                                                                                                                               | [Bitbucket Cloud PR comments](/semgrep-appsec-platform/bitbucket-cloud-pr-comments)     |
    | Triage through PR comments (Cloud) | **Product Admin**. Requires **Bitbucket Cloud Premium** and a workspace access token.                   | <ul><li>`webhook (read and write)`</li><li>`repository (read and write)`</li><li>`pullrequest (read and write)`</li><li>`project (admin)`</li><li>`account (read)`</li></ul>                                                                                               | [Bitbucket Cloud PR comments](/semgrep-appsec-platform/bitbucket-cloud-pr-comments)     |
    | Managed Scans (Cloud)              | **Product Admin**                                                                                       | <ul><li>`webhook (read and write)`</li><li>`repository (read and write)`</li><li>`pullrequest (read and write)`</li><li>`project (admin)`</li><li>`account (read)`</li></ul>                                                                                               | [Bitbucket Managed Scans](/deployment/managed-scanning/bitbucket#bitbucket-cloud)       |
    | Managed Scans (Data Center)        | **Project Admin**                                                                                       | HTTP access token with **Project admin** permissions                                                                                                                                                                                                                       | [Bitbucket Managed Scans](/deployment/managed-scanning/bitbucket#bitbucket-data-center) |
    | Code access                        | User who can update the SCM connection token                                                            | Connection token scopes (colon notation): <ul><li>Cloud:<ul><li>`repository:read`</li><li>`pullrequest:read`</li><li>`repository:write`</li><li>`pullrequest:write`</li></ul></li><li>Data Center:<ul><li>`repository:read`</li><li>`repository:write`</li></ul></li></ul> | [Grant code access](/semgrep-appsec-platform/scm-code-access)                           |
    | Autofix (Cloud)                    | **Product Admin**. Requires **Bitbucket Cloud Premium** and a workspace access token.                   | <ul><li>`repository (read and write)`</li><li>`pullrequest (read and write)`</li></ul>                                                                                                                                                                                     | [Autofix](/semgrep-code/triage-remediation/autofix)                                     |
    | Autofix (Data Center)              | **Project Admin**                                                                                       | HTTP access token with **Project admin** permissions and repository write access                                                                                                                                                                                           | [Autofix](/semgrep-code/triage-remediation/autofix)                                     |
  </Tab>

  <Tab title="GitHub Cloud">
    Semgrep recommends connecting GitHub with a [private Semgrep GitHub App](#private-github-app-permissions). That is the default install path in Semgrep AppSec Platform. Some organizations instead use a [personal access token (PAT)](#github-personal-access-tokens). The table below covers the GitHub App path. For PAT roles and scopes, see [GitHub personal access tokens](#github-personal-access-tokens).

    | Feature                                | Role                                                                       | Scopes                                                                                                                                                                                                                                        | Configure                                                                                                                                       |
    | :------------------------------------- | :------------------------------------------------------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------- |
    | Sign in and connect repositories       | Org member who can install GitHub Apps on the organization                 | Private Semgrep GitHub App installation. See [GitHub App permissions](#github-app-permissions).                                                                                                                                               | <ul><li>[Connect a source code manager](/deployment/connect-scm)</li><li>[Create an account](/deployment/create-account-and-orgs)</li></ul>     |
    | Create CI jobs in bulk                 | Org member who can install GitHub Apps                                     | Same as the private Semgrep GitHub App permissions for repository onboarding                                                                                                                                                                  | [Connect a source code manager](/deployment/connect-scm)                                                                                        |
    | PR comments                            | Org member who can configure the Semgrep GitHub App on target repositories | <ul><li>`actions (read and write)`</li><li>`pull requests (read and write)`</li><li>`secrets (read and write)`</li><li>`security events (read and write)`</li><li>`workflows (read and write)`</li></ul>                                      | [GitHub PR comments](/semgrep-appsec-platform/github-pr-comments)                                                                               |
    | Managed Scans and AI-assisted features | Org member who can install GitHub Apps                                     | Private Semgrep GitHub App with `Contents: Read` and permissions listed in [Private GitHub App permissions](#private-github-app-permissions)                                                                                                  | <ul><li>[GitHub Managed Scans](/deployment/managed-scanning/github)</li><li>[Semgrep Multimodal](/semgrep-multimodal/getting-started)</li></ul> |
    | Autofix                                | Org member who can install GitHub Apps                                     | Private Semgrep GitHub App repository permissions: <ul><li>`Contents: Read`</li><li>`Contents: Write`</li><li>`Metadata: Read`</li><li>`Pull requests: Write`</li></ul> See [Autofix permissions and API usage](#autofix-github-permissions). | <ul><li>[Autofix](/semgrep-code/triage-remediation/autofix)</li><li>[Grant code access](/semgrep-appsec-platform/scm-code-access)</li></ul>     |
  </Tab>

  <Tab title="GitLab Cloud">
    | Feature                                | Role                                                                                                                                | Scopes                                                                                                | Configure                                                                                                                                       |
    | :------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------- |
    | Sign in                                | GitLab user authorizing Semgrep                                                                                                     | <ul><li>`openid`</li><li>`email`</li><li>`profile`</li><li>`api`</li></ul>                            | [Connect a source code manager](/deployment/connect-scm)                                                                                        |
    | MR comments                            | <ul><li>**Owner**</li><li>**Admin**</li></ul> on the GitLab group                                                                   | <ul><li>`api` on the group access token</li></ul>                                                     | [GitLab MR comments](/semgrep-appsec-platform/gitlab-mr-comments)                                                                               |
    | Managed Scans and AI-assisted features | <ul><li>**Maintainer**</li><li>**Owner**</li><li>**Admin**</li></ul> during onboarding (can downgrade to **Developer** after setup) | <ul><li>`api` on group or personal access token</li><li>`read_repository` for code access</li></ul>   | <ul><li>[GitLab Managed Scans](/deployment/managed-scanning/gitlab)</li><li>[Semgrep Multimodal](/semgrep-multimodal/getting-started)</li></ul> |
    | Code access                            | User who can update the SCM connection token                                                                                        | Connection token scopes: <ul><li>`read_repository`</li><li>`write_repository`</li></ul>               | [Grant code access](/semgrep-appsec-platform/scm-code-access)                                                                                   |
    | Autofix                                | <ul><li>**Maintainer**</li><li>**Owner**</li><li>**Admin**</li></ul> during onboarding (can downgrade to **Developer** after setup) | Connection token scopes: <ul><li>`api`</li><li>`read_repository`</li><li>`write_repository`</li></ul> | [Autofix](/semgrep-code/triage-remediation/autofix)                                                                                             |
  </Tab>
</Tabs>

## GitHub permissions

Semgrep recommends connecting GitHub with a GitHub App. Some organizations use a personal access token (PAT) instead. Use the tabs below for the method that applies to you.

<Tabs>
  <Tab title="GitHub App (recommended)">
    <div id="github-app-permissions" />

    ### Public and private Semgrep GitHub Apps

    New GitHub connections install a single **private** Semgrep GitHub App. Older organizations may still have the public [`semgrep-app`](https://github.com/apps/semgrep-app) from an earlier install path. You can uninstall the public app if it is no longer needed.

    | App                         | Typical name                                                            | What it is for                                                                                                                                                                                                                                                                                                                        |
    | :-------------------------- | :---------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
    | **Private** (default)       | **Semgrep Code - <span className="placeholder">YOUR\_ORG\_NAME</span>** | Connecting your organization, listing repositories and members, PR comments, CI onboarding, and code access for [Managed Scans](/deployment/managed-scanning/overview), [Semgrep Multimodal](/semgrep-multimodal/overview), and [Autofix](/semgrep-code/triage-remediation/autofix). Your organization creates and installs this app. |
    | **Public** (older installs) | [`semgrep-app`](https://github.com/apps/semgrep-app)                    | Sign-in, connecting your organization, listing repositories and members, PR comments, and CI onboarding such as writing workflow files.                                                                                                                                                                                               |

    The sections below describe the permissions each app can request.

    ### Permissions when signing in with GitHub

    Semgrep AppSec Platform requests the following standard permissions set by GitHub when you first sign in. However, not all permissions are used by Semgrep AppSec Platform.

    <Accordion title="Click to review how Semgrep AppSec Platform uses permissions when signing in.">
      **Verify your GitHub identity**<br />
      Enables Semgrep AppSec Platform to read your GitHub profile data, such as your username.

      **Know which resources you can access**<br />
      Semgrep does not use or access any resources when first logging in. However, you can choose to share resources at a later point to add repositories into Semgrep AppSec Platform.

      **Act on your behalf**<br />
      Enables Semgrep AppSec Platform to perform certain tasks **only on resources that you choose to share with Semgrep AppSec Platform**. Semgrep AppSec Platform never uses this permission and never performs any actions on your behalf, even after you have installed `semgrep-app`. For more information, see [What does 'Act on your behalf' mean?](/kb/semgrep-appsec-platform/act-on-your-behalf) and [GitHub Apps acting on your behalf](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/authorizing-github-apps) in GitHub documentation.
    </Accordion>

    ### Public GitHub App permissions

    The public GitHub integration app is called [`semgrep-app`](https://github.com/apps/semgrep-app). This app integrates Semgrep into user-selected GitHub repositories.

    <Accordion title="Click to review how Semgrep AppSec Platform uses public GitHub App permissions.">
      **Reading metadata of the repositories you select**<br />
      Enables Semgrep AppSec Platform to list repository names on the project setup page.

      **Reading the list of organization members**<br />
      Enables Semgrep AppSec Platform to determine who can manage your Semgrep organization based on your GitHub organization's members list.

      **Reading and writing pull requests**<br />
      Enables Semgrep AppSec Platform to comment about findings on PRs. Read permissions allow Semgrep AppSec Platform to automatically remove findings when the PR that introduced them is closed without merging.

      **Reading and writing actions**<br />
      Enables Semgrep AppSec Platform to cancel stuck jobs, rerun jobs, pull logs from jobs, and perform on-demand scanning.

      **Reading [GitHub Checks](https://docs.github.com/en/rest/reference/checks)**<br />
      Facilitates debugging of Semgrep AppSec Platform when configured out of [GitHub Actions](https://docs.github.com/en/actions).

      **Reading and writing security events**<br />
      Enables integration with GitHub Advanced Security (for example, to show Semgrep results).

      **Reading and writing secrets**<br />
      Enables the automatic adding of the Semgrep AppSec Platform Token to your repository secrets when onboarding projects. Note: Semgrep cannot read the values of your existing or future secrets (only the names).

      **Reading and writing 2 files**<br />
      Enables Semgrep AppSec Platform to configure itself to run in CI by writing to `.github/workflows/semgrep.yml` and `.semgrepignore` files.

      **Reading and writing workflows**<br />
      Enables Semgrep AppSec Platform to configure itself to run in CI by writing to `.github/workflows/semgrep.yml`. GitHub allows writing to files within `.github/workflows/` directory only if this permission is granted along with "Writing a single file."
    </Accordion>

    <h3 id="private-github-app-permissions">
      Private GitHub App permissions
    </h3>

    <div id="permissions-for-managed-scans-and-ai-features" />

    During the connection process, your organization creates a private GitHub App from Semgrep's template, named **Semgrep Code - <span className="placeholder">YOUR\_ORG\_NAME</span>**. That app provides repository **Contents** access and related permissions for:

    * [Semgrep Managed Scans](/deployment/managed-scanning/overview)
    * [Semgrep Multimodal](/semgrep-multimodal/overview) and other AI-assisted features
    * [Semgrep Code Autofix](/semgrep-code/triage-remediation/autofix)

    Managed Scans and Multimodal need **Contents: Read**. Autofix needs **Contents: Read and write** and **Pull requests: Write**. For roles and scopes by feature, see the GitHub Cloud rows in [Permissions](#permissions). To grant or update Contents access, see [Grant code access](/semgrep-appsec-platform/scm-code-access).

    <Accordion title="Click to review how Semgrep AppSec Platform uses private GitHub App permissions.">
      **Reading metadata of the repositories you select**<br />
      Lets Semgrep list their names on the project setup page.

      **Reading the list of organization members**<br />
      Lets Semgrep determine who can manage your Semgrep organization based on your GitHub organization's members list.

      **Writing (and reading) pull requests**<br />
      Lets Semgrep comment about findings on PRs.

      **Writing (and reading) actions**<br />
      Allows Semgrep AppSec Platform to cancel stuck jobs, rerun jobs, pull logs from jobs, and perform on-demand scanning.

      **Reading checks**<br />
      Facilitates debugging of Semgrep AppSec Platform when configured out of GitHub Actions.

      **Writing (and reading) security events**<br />
      Enables integration with GitHub Advanced Security (for example, to show Semgrep results).

      **Writing (and reading) secrets**<br />
      Enables automatic adding of the Semgrep AppSec Platform Token to your repository secrets when onboarding projects. Note: Semgrep cannot read the values of your existing or future secrets (only the names).

      **Writing (and reading) 2 files**<br />
      Lets Semgrep configure itself to run in CI by writing to `.github/workflows/semgrep.yml` and `.semgrepignore`.

      **Writing (and reading) workflows**<br />
      Lets Semgrep configure itself to run in CI by writing to `.github/workflows/semgrep.yml`. GitHub allows writing to files within `.github/workflows/` only if this permission is granted along with "Writing a single file."

      **Read source code of the repositories you select**<br />
      Allows Semgrep Multimodal to fetch source code files on-demand to construct AI prompts.
    </Accordion>

    <h4 id="autofix-github-permissions">
      Autofix permissions and API usage
    </h4>

    <div id="autofix-permissions" />

    Autofix uses your **private Semgrep GitHub App** with the permissions below. Use this section for security reviews of Autofix on GitHub, such as determining which GitHub operations require **Contents: Read and write**.

    ##### Repository permissions

    | GitHub App permission    | Why Autofix needs it                                                                                                   |
    | :----------------------- | :--------------------------------------------------------------------------------------------------------------------- |
    | **Contents: Read**       | Clone the repository over HTTPS using Git (shallow, single-branch) so Semgrep can analyze the code and generate a fix. |
    | **Contents: Write**      | Push the Autofix branch back to the repository over HTTPS using Git.                                                   |
    | **Metadata: Read**       | Read repository metadata, including the default branch, using `GET /repos/{owner}/{repo}`.                             |
    | **Pull requests: Write** | Open a **draft** PR using `POST /repos/{owner}/{repo}/pulls`.                                                          |

    ##### How repository contents are accessed

    Semgrep Autofix reads and writes code only through the **Git transport layer** (clone and push), not through the API `contents` endpoints (`GET` or `PUT` `/repos/{owner}/{repo}/contents/{path}`). Git operations still require the GitHub **Contents** permissions above.
  </Tab>

  <Tab title="Personal access tokens">
    <div id="github-personal-access-tokens" />

    Use a personal access token (PAT) when your organization connects GitHub to Semgrep with a token instead of a GitHub App. Semgrep recommends a **fine-grained** PAT. **Classic** PATs remain supported as well.

    A PAT can only grant access that the creating GitHub user already has. Use a [machine user](https://docs.github.com/en/authentication/connecting-to-github-with-ssh/managing-deploy-keys#machine-users) when possible. That user must be a member of the target organization, or a collaborator on the selected repositories. For [Autofix](/semgrep-code/triage-remediation/autofix), the user must be able to push branches and open pull requests on those repositories.

    When you save a token or click **Test** on [**Settings > Source code managers**](https://semgrep.dev/orgs/-/settings/source-code), Semgrep validates that the PAT can access the connected organization. That check uses the same minimum scopes as code read access. It does **not** require additional scopes beyond those listed for **Connect or Test SCM connection** and **Code access** below.

    | Feature                                              | Role                                                                                      | Fine-grained scopes (recommended)                                                                                                                                                                                                                                   | Classic scopes                                                                                                                                                                                                             | Configure                                                                                                                                                                                                                                                                             |
    | :--------------------------------------------------- | :---------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
    | Connect or Test SCM connection                       | Org member or collaborator who can create a PAT for the target org or repositories        | <ul><li>**Resource owner**: the GitHub organization Semgrep connects to</li><li>**Repository access**: all or selected repositories Semgrep uses</li><li>**Metadata: Read**. GitHub includes this automatically when you grant any repository permission.</li></ul> | <ul><li>`repo` for private repositories</li><li>`public_repo` if the connection only needs public repositories</li></ul> If the organization uses SAML SSO, authorize the token for that organization after you create it. | <ul><li>[Connect a source code manager](/deployment/connect-scm)</li><li>[Grant code access](/semgrep-appsec-platform/scm-code-access#grant-code-access-to-semgrep-for-token-based-scm-connections)</li></ul>                                                                         |
    | Code access, Managed Scans, and AI-assisted features | Same as above; user must be able to read the target repositories                          | <ul><li>All **Connect or Test** requirements</li><li>**Contents: Read**</li></ul>                                                                                                                                                                                   | Same as **Connect or Test**: `repo` or `public_repo`. Classic `repo` includes content read.                                                                                                                                | <ul><li>[Grant code access](/semgrep-appsec-platform/scm-code-access#grant-code-access-to-semgrep-for-token-based-scm-connections)</li><li>[Semgrep Managed Scans](/deployment/managed-scanning/overview)</li><li>[Semgrep Multimodal](/semgrep-multimodal/getting-started)</li></ul> |
    | Autofix                                              | Same as above; user must be able to push branches and open PRs on the target repositories | <ul><li>All **Code access** requirements</li><li>**Contents: Read and write**</li><li>**Pull requests: Read and write**</li></ul>                                                                                                                                   | `repo`, which includes content write and pull request write. `public_repo` is not enough for private repositories.                                                                                                         | <ul><li>[Autofix](/semgrep-code/triage-remediation/autofix)</li><li>[Grant code access](/semgrep-appsec-platform/scm-code-access#grant-code-access-to-semgrep-for-token-based-scm-connections)</li></ul>                                                                              |
  </Tab>
</Tabs>

## Next steps

* [Grant code access](/semgrep-appsec-platform/scm-code-access): configure code read or write access on an SCM connection
* [Connect a source code manager](/deployment/connect-scm): connect GitHub, GitLab, Bitbucket, or Azure DevOps
* [Pre-deployment checklist](/deployment/checklist): organizational readiness before setup
* [Autofix](/semgrep-code/triage-remediation/autofix): enable and use Autofix
* [Semgrep Multimodal](/semgrep-multimodal/getting-started): enable Multimodal and related AI-assisted features
* [GitHub Managed Scans](/deployment/managed-scanning/github): install the Semgrep GitHub App for Managed Scans