Works with · Snyk · Semgrep
Do Snyk or Semgrep checks count as code review for SOC 2?
No. Snyk and Semgrep are scanners. Their check results are exactly the kind of secure-coding gate a model should require before approval, but a green check is not an approval by a qualified person other than the author. PSCO requires the checks and adds the Officer.
How Snyk · Semgrep reviews
Snyk and Semgrep run as checks on each push, reporting vulnerabilities, misconfigurations and policy violations, and can post comments or open fix PRs.
What it cannot do
A scanner cannot be the independent human approver. Auditors treat SAST and dependency scanning as separate controls from code review; both are needed, and neither substitutes for the other.
How PSCO reads its output
PSCO reads Snyk and Semgrep check runs as required-check status. List them in required_checks in your model and the Officer cannot approve while they are red.
Two-step setup
Keep Snyk · Semgrep.
Keep Snyk and Semgrep running as checks.
Add PSCO.
Install the PSCO GitHub App, pick the repos in scope, and add psco/approved and one approval from @psco-officers to branch protection.
The shared-model tip
Point it at the same model the Officer uses.
Name the Snyk and Semgrep check runs in required_checks in psco.model.yaml so the Officer’s gate and your scanners agree on what must be green.
frameworks: [soc2, iso27001] sensitive_paths: auth/**: deep infra/**: deep required_checks: [ci, tests, sast, secrets] forbidden: [hardcoded_secret, tls_verify_off]
Other reviewers
Claude Code · Codex · GitHub Copilot · Cursor Bugbot · CodeRabbit · Greptile · Graphite Diamond · Qodo · Macroscope · Devin Review · Ellipsis · Sourcery · Bito AI Code Review Agent · CodeAnt AI · repowise · Gemini Code Assist · Amazon Q Developer · Augment Code · Dependabot · Renovate · All
Keep Snyk · Semgrep. Add the human who signs.
Connect GitHub and PSCO detects the reviewers already on your repos. Your price comes from your real PR history.