Semgrep Supply Chain

Semgrep Supply Chain is the SCA component of the Semgrep AppSec Platform. Dependency identification covers direct and transitive packages declared in major package managers (npm, Maven, NuGet, pip, gems, Go modules, Cargo, Composer). The product's differentiator is dataflow reachability that traces vulnerable dependency code through the application's actual execution paths to find what is reachable rather than only what is declared.

Dataflow reachability differentiates reachable-and-exploitable paths from reachable-but-safe paths. Function-level reachability stops at whether the vulnerable function is called. Dataflow reachability extends further by tracing whether the input pattern that triggers the vulnerability actually flows from the customer's application code into that function. The result is a backlog where prioritization grounds in real-world exploitability rather than theoretical severity.

Recent platform expansion includes Kotlin reachability (announced 2025) extending the dataflow analysis to mobile and JVM-modern stacks. Tight integration with Semgrep Code shares the same dataflow analysis foundations across SAST and SCA so the consolidated findings surface produces unified prioritization. Programs running both products see paired findings under one policy plane rather than stitched across separate scanners.

Merito's Semgrep Supply Chain rollout starts with the dependency baseline against the customer's existing package-manager inventory, then reachability calibration on the language coverage in scope, then license-policy authoring against the customer's risk tolerance, then SBOM workflow integration. Programs that adopt SCA and never write the policies generate noise the security team learns to ignore.

Function-level reachability is better than no reachability. Dataflow reachability is better still because it traces input patterns from customer code into vulnerable dependency code rather than only identifying that the vulnerable function is called. Programs that adopt Semgrep Supply Chain expecting the reachability math to work without calibration get less value than promised.

Shared dataflow with Semgrep Code is genuinely the differentiator for programs running both products. Customers see paired SAST plus SCA findings under one policy plane rather than stitched across separate scanners. The integration depth is what consolidating to Semgrep produces. Running standalone Semgrep Supply Chain against a competing SAST tool loses that benefit.

Default policies and Pro Rules produce volume. License policies and reachability calibration produce signal. Merito's first thirty days on every Supply Chain rollout include the dependency baseline, reachability calibration on the customer's specific language stack, and license policy authoring against the customer's risk tolerance.