Semgrep Secrets Integration Guide

Integrate Semgrep Secrets scanning with Vulnetix. Use Semgrep's p/secrets ruleset to detect API keys, tokens, passwords, and credentials hardcoded in source code.

Install & scan

$ # Recommended - run without global install
uv run --with semgrep semgrep --version

# Install globally
pip install semgrep
$ uv run --with semgrep semgrep scan   --config p/secrets   --sarif   --sarif-output=semgrep-secrets.sarif .

Run Semgrep Secrets in CI

Scan on every push and upload the report as a workflow artifact:

- name: Semgrep Secrets scan
  run: |
    pip install semgrep
    semgrep scan --config p/secrets --sarif --sarif-output=semgrep-secrets.sarif .

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: semgrep-secrets
    path: semgrep-secrets.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Semgrep Secrets's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Semgrep Secrets. Keep running it. Vulnetix sits on top of Semgrep Secrets (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Semgrep Secrets is strongest at its core category and also carries features in SAST, SCA, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Semgrep Secrets does well

• Semantic dataflow analysis (constant propagation, cross-function tracking) catches secrets that survive variable reassignment, far fewer false positives than pure regex/entropy tools
• Local validity checks classify findings as confirmed valid/invalid so engineers triage live leaks first
• Part of the broader Semgrep platform, so secrets share tooling with mature SAST and SCA/supply-chain scanning
• p/secrets ruleset covers a broad set of credential types across many languages, maintained by the Semgrep team

Where Vulnetix adds to it: Semgrep Secrets shares the same engine Vulnetix embeds for SAST, so they are natural partners. Vulnetix runs Semgrep and ingests Semgrep Secrets output, then dedups across SCA/IaC/container/cloud scanners and layers exploit-intel (EPSS/KEV/ESS/LEV), immutable versioned VEX, Safe Harbour autofix and SSVC that Semgrep does not provide. Better together: Semgrep finds it, Vulnetix prioritises and governs it org-wide.

No migration, no rip-and-replace. Semgrep Secrets keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Semgrep Secrets results in Vulnetix

Upload Semgrep Secrets SARIF, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Semgrep Secrets documentation ↗  ·  Source repository ↗

Wire Semgrep Secrets into your CI/CD pipeline →