Semgrep: Semgrep Secrets False Positives
Timeline of updates
- resolved
2024-01-09 21:00 UTC Engineering has identified and is currently investigating an issue where Semgrep Secrets surfaced false positive findings. The cause was determined to be that rules from an internal training were accidentally applied to customer scans. The only impact to customers were the false positives shown by the Secrets product, no sensitive data was displayed to customers. 2024-01-09 22:00 UTC We disabled the ability to add new Semgrep Secrets rules to prevent additional rules from being mistakenly applied to customer scans while we continued to remediate the underlying issue. 2024-01-10 01:00 UTC We removed the previously mentioned rules. Scans completed after this time would remove any false positives findings previously identified. Customers that still see false positives should re-run a scan against the impacted projects. Please reach out to Semgrep support if this does not resolve the issue.
From Semgrep’s published incident history: for incidents before Rewindex began polling this status page, only the final update text is available.
Archive proof
Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert.
How the archive is checked, and what it cannot prove.
This incident predates live tracking (October 17, 2026). It came from the vendor’s own published history, which is not covered by checkpoints.
Impact, status and times are the vendor’s own, as last archived. View on status.semgrep.dev (opens in new tab).
Cite this
Status incident (vendor impact label: minor) posted by Semgrep, started 2024-01-09 21:00 UTC, resolved after 0 min, 1 update(s).
- Title
- Semgrep Secrets False Positives
- Vendor
- Semgrep
- Date
- URL
- https://rewindex.com/company/semgrep/incidents/vhk9wpxrfgcv
Semgrep profileRecent Semgrep incidentsAll outages on January 9, 2024Semgrep in January 2024MarkdownJSON