Supply Chain Findings

Fetches software supply chain-related findings from Semgrep to identify third-party risk.

Sync Type: Incremental

Requirements

• Before you connect Monad to Semgrep, you need an API token. API tokens are scoped to include all code findings from a specific account in Semgrep.
• Please make sure that your account is on Semgrep Code Team tier to have access to the API endpoints.
• To generate a new Semgrep API key,
• Log in to Semgrep, and check to confirm which account you are using. If needed, switch to the account that you want to connect to Monad.
• Click Settings > Tokens > Create new token.
• In the dialog that appears, make sure that WebAPI is selected and Agent (CI) is deselected in the Token Scopes section.
• In the Description, enter something like Monad Connector token so that it's clear later what this token is for.
• Copy the Secrets Value (the token value) to a secure place so you can use it to set up the connector. Once you close this dialog, you cannot view the token value again.

Details

Monad uses the since filter on the API to determine which findings to display. This field is updated every time a request to get findings is successful with the last time a request to get findings was initiated. If this was the first time requesting for findings, a full sync of the data is performed.

Settings

Secrets

OCSF Conversion

The following JQ transformation converts Semgrep Code Finding data to OCSF Version 1.1.0 compliant format.

Sample Record

Code
{
  "id": 3036615,
  "ref": "refs/pull/5845/merge",
  "first_seen_scan_id": 9931,
  "syntactic_id": "0fce095f-c9f5-6918-3eaa-096ea07e88f9",
  "match_based_id": "7e96b193-ff68-d2c0-8485-3a6f34116c76_2",
  "repository": {
    "name": "static-checks",
    "url": "https://github.com/semgrep/semgrep"
  },
  "line_of_code_url": "https://github.com/semgrep/semgrep/blob/8f56c040-923f-f831-6ba7-5c816f314a09/src/core_cli/Core_CLI.ml#L997",
  "triage_state": "untriaged",
  "state": "resolved",
  "status": "open",
  "severity": "low",
  "confidence": "low",
  "categories": [
    "security"
  ],
  "created_at": "2025-08-11T23:46:37.549344Z",
  "relevant_since": "2025-08-11T23:46:37.54935Z",
  "rule_name": "typescript.react.security.audit.react-no-refs.react-no-refs",
  "rule_message": "`ref` usage found. refs give direct DOM access and may create a possibility for XSS, which could cause sensitive information such as user cookies to be retrieved by an attacker. Instead, avoid direct DOM manipulation or use DOMPurify to sanitize HTML before writing it into the page.",
  "location": {
    "file_path": "frontend/src/corpComponents/Code.tsx",
    "line": 100,
    "column": 26,
    "end_line": 271,
    "end_column": 40
  },
  "sourcing_policy": {
    "id": 720,
    "name": "Custom Policy",
    "slug": "custom-policy"
  },
  "triaged_at": "2025-08-11T23:46:37.549437Z",
  "triage_comment": "sed nostrud aute ut mollit mollit sed in sed nulla",
  "triage_reason": "acceptable_risk",
  "state_updated_at": "2025-08-11T23:46:37.549469Z",
  "rule": {
    "name": "html.security.plaintext-http-link.plaintext-http-link",
    "message": "This link points to a plaintext HTTP URL. Prefer an encrypted HTTPS URL if possible.",
    "confidence": "high",
    "category": "security",
    "subcategories": [
      "vuln"
    ],
    "vulnerability_classes": [
      "Mishandled Sensitive Information"
    ],
    "cwe_names": [
      "CWE-319: Cleartext Transmission of Sensitive Information"
    ],
    "owasp_names": [
      "A03:2017 - Sensitive Data Exposure",
      "A02:2021 - Cryptographic Failures"
    ]
  },
  "assistant": {
    "autofix": {
      "fix_code": "cookie.setHttpOnly(true);\nresponse.addCookie(cookie);",
      "explanation": "This fix requires an additional library to be imported."
    },
    "autotriage": {
      "verdict": "true_positive",
      "reason": "The matched code is used for a non-security related feature."
    },
    "component": {
      "tag": "user data",
      "risk": "low"
    }
  }
}

Sync frequency

By default this input polls approximately every 10 seconds, with each sync beginning after the previous one completes. A cron schedule configured on the pipeline overrides this cadence. See Input Sync Frequency for details.