Tools · Secrets and dependency scanning · 25 / 26
Semgrep: severity is not the finding count
Severity on a Semgrep finding is the label on that rule. A count is how many findings you have. Write the label and the count as different facts. Four warnings are four findings, not severity 4.
Severity is a word on the rule
Each finding can carry a severity such as INFO, WARNING, or ERROR. That word is the label the rule was given. It is copied onto the finding. It is not a tally of how many times the rule matched.
The same word can appear on many findings. The word does not say how many.
The count is how many rows
If you need a number, count the findings, and say whether you mean all of them or only those with one severity. “4” next to WARNING is a count you computed. It is not a severity called 4.
Do not add severities together. There is nothing to add.
What to file
File each finding’s rule id and severity word. File a count only with the set you counted. Do not replace the rule id with the severity word when you say which rule fired.
Worked case: four warnings read as severity 4
A lab run has four findings, each with severity WARNING and its own rule id. A draft says the scan’s severity is 4 and files a single issue with no rule ids.
The note says four findings, each WARNING. The number 4 is the count. It is not a severity. The four rule ids stay on the note.
findings: 4 each severity: WARNING rule ids: four distinct ids on the rows write: count 4, label WARNING not: severity 4, and not one issue with no ids
Diagram
A label and a count
WARNING does not become the number of rows.
Is. The word on each finding
Example. WARNING
Does not. Equal the number of findings
Is. How many findings you counted
Example. 4
Needs. The rule ids, if you are listing them
Check yourself
1. Four findings are each marked WARNING. What is WARNING?
2. You want to report how many findings there were. What do you write?
3. Two findings share a severity and have different rule ids. What follows?