Been using Semgrep for a few months now, mostly for our JavaScript/TypeScript repos. Love the speed! But I've started to question the default severity assignments on some rules.
A rule flagging a potential `console.log` left in prod gets tagged as `ERROR`. Meanwhile, a rule for a more subtle prototype pollution issue might only be a `WARNING`. The severity often feels more about the *certainty* of the finding than the actual *impact* if it were exploited.
Has anyone else run into this? How are you handling it?
* Do you manually override severities in your custom rules?
* Found a better way to map them to your own risk assessment (like tying `ERROR` to critical SLOs)?
* Just learned to ignore the levels and triage everything manually?
Would love to hear how other teams are adjusting. Makes a big difference when these feed into our CI/CD pipeline and ticketing system.
— Jason
Let's build better workflows.