.png&w=2560&q=75)
Semgrep Guardian now supports Codex, allowing Codex users to run Semgrep Code, Supply Chain, and Secrets scans from a Semgrep-hosted server without the Semgrep CLI.
Semgrep Guardian support for Codex
Codex receives the same Guardian capabilities as Claude Code. It uses the fixed guardian-default ruleset rather than an organization’s Policies. Windows environments require Windows Subsystem for Linux (WSL).
GitHub webhook and connection changes
Rotating the secret for a customer-owned GitHub App now updates existing webhooks too, preventing pull request workflows from losing their trigger after rotation. This applies to GitHub Cloud and GitHub Enterprise. For stale webhook secrets, use Settings > Source code managers and select Rotate webhook secret.
For self-hosted source code managers, Semgrep now explains expected connection failures and retains the saved connection so it can be corrected and retried. New connections must use a hostname in the base URL, not an IP address; existing connections are unchanged.
Findings API Autofix results
GET /api/v1/deployments/{deploymentSlug}/findings now returns click_to_fix_prs and click_to_fix_failures for Semgrep Code and AI-powered detection findings across every deployment. The fields report Autofix-created pull requests and failed Autofix attempts. Previously, deployments outside the Autofix beta received empty lists.
Supply Chain Autofix triage
When Supply Chain Autofix creates a pull request, an Open or Reviewing finding moves to To fix, matching Semgrep Code Autofix behavior. Findings already in another triage state retain that state, and failed pull request creation does not alter it.
AI provider and workflow controls
Semgrep Multimodal now offers Automatic and Manual AI-provider selection. Automatic mode, used when Multimodal is enabled, lets Semgrep manage its provider list, including Amazon Bedrock, Cloudflare Workers AI, and OpenAI.
Only organization administrators can create, change, delete, or view Agentic Workflows schedules through the API, or trigger individual, pack, and bulk workflow runs. The workflow scheduling page now counts credits from every trigger, including pull request-triggered runs, in Total credits used.
Reliability fixes
Semgrep corrected Managed Scans fail-open behavior so delayed scans or temporarily unavailable source code managers do not leave pull requests or merge requests blocked beyond the configured deadline. The default remains 10 minutes and can be changed. Changing a GitHub pull request base branch now starts a new diff-aware scan; title and description edits still do not.
Agentic Workflows runs can now continue for up to five hours instead of being marked failed after two hours. Stored xAI, OpenAI, and Google Gemini keys are retained when saved without re-entry; Azure OpenAI no longer fails in that case. Changing an Azure OpenAI or xAI endpoint to another host still requires re-entering the key. Bring-your-own keys are available to Semgrep Enterprise and users who already had them.
Read-only Agentic Workflows can now run against Cursor Origin repositories when the installation lacks write access or uses another API host. Semgrep also fixed repeated Autotriage failures for Generic secrets issues with more than one triage result.
Based on the official Semgrep release notes.
How Merito helps
Merito helps teams set ownership for Semgrep configuration, AI-provider controls, and workflow governance through its Semgrep services and Managed Services.
Merito is an authorized Semgrep reseller and services partner. Our Semgrep team helps you adopt the October 2026 changes, with implementation services to configure them for your environment and training and enablement to bring your teams up to speed.