Semgrep: a finding is the lines that matched

The evidence is the match location

Semgrep reports a rule id, a path, a start line, and the lines of code the pattern matched. That is the finding. Someone can open that file at that line and see the same shape. The finding does not say the branch is unsafe, and it does not say the matched code runs in production.

If the scan used a baseline, the finding is also “new relative to that baseline.” Write the baseline commit when you have it, so a reader does not treat a new-code result as a full-repo audit.

Message and severity travel with the rule

The message is text the rule author wrote. Severity is the label on the rule. Both are copied onto every match. A message that says a problem is “possible” or “detected” is the rule talking, not a test that exercised the program.

A comment that suppresses a rule is an exception record next to the line. It is not evidence the line is correct. If you cite a suppression, cite the comment’s reason as a decision, separate from the finding.

What to file

File the rule id, path, start line, the matched snippet, the message as the rule’s text, the severity label, and the baseline if one was set. Do not rewrite the message into a stronger claim. Do not attach a snippet that itself contains a secret; quote the line numbers instead.

Worked case: a message that overreaches

Rule hb-no-debug-print matches app/health.py line 12, snippet print("health ok"), severity WARNING, message “Possible sensitive value in a print.” The scan’s baseline is the merge base of the lab branch. A draft ticket says customer data was logged.

The note quotes the rule id, the path, the line, and the snippet, and says the message is the rule’s text. The matched line is a fixed string. The finding shows the pattern matched. It does not show a sensitive value. The baseline commit is named so the result is not described as a scan of the whole repository.

rule: hb-no-debug-print
path: app/health.py  line: 12
snippet: print("health ok")
severity: WARNING (label on the rule)
message: rule text, not a confirmed defect
baseline: merge-base of the branch