What does a rule match tell you?
A match tells you that code fits a pattern. Read the surrounding code and decide whether it applies in your app. Run your ordinary tests after fixing it. A report with no matches only covers the rules and files you chose.
Which parts can you run yourself?
Semgrep Community Edition offers a local engine under LGPL 2.1. Check the license for the rules you use separately, since Semgrep-maintained rules have their own terms. Use your own approved source files and review whether any connected service receives code.
What changes if you use the platform?
The managed platform has separate features and pricing. Check which product you need, how contributors are counted and any separate credit limits before choosing a plan. Keep your rule choices, the scan scope and the checks you expect to repeat.
Is a fictional debug statement safe to keep?
On paper, imagine a rule that flags a debug statement printing a whole customer record. Review why a developer added it and which field, if any, they actually need.
- Inspect the contextList the fields a support teammate should and should not see in a diagnostic log.
- Choose a small correctionPropose logging only an approved status. Write a test expectation showing the diagnostic remains useful without customer details.