Easy to Use
Semgrep offers a straightforward setup and simple syntax, making it easy for developers to start using it for static code analysis without extensive configuration.
Language Support
It supports a wide range of programming languages, including popular ones like Python, JavaScript, Java, and more, making it versatile for different codebases.
Customizable Rules
Users can create custom rules tailored to their specific codebase needs, allowing for more control and precision over code analysis.
Real-time Analysis
Semgrep can be integrated into CI/CD pipelines, providing real-time feedback on code submissions and helping to catch issues early in the development process.
Open Source
Being open source, it allows for community contributions and transparency, enabling users to understand and trust the tool more deeply.
Promote Semgrep. You can add any of these badges on your website.
Also, we can use a tool like Semgrep to audit the use of the middleware through all routes using a custom rule, to show a simple example we can use a rule like the below (Note this is just example which covers one way of defining routes in Express, for production the rule needs to be extended to include all other ways of defining routes). - Source: dev.to / 10 months ago
> Not sure I understand your point. The problem is using Treesitter (for syntax highlighting and "semantic movements") and an LSP at the same time. So if your language has a LSP, using Treesitter additionally is redundant at best and introduces inconcistency at worst. I'm not talking about using Treesitter as the parser for the LSP. > Most popular languages have language-specific tools I'd say even less popular... - Source: Hacker News / over 1 year ago
This project is a compilation of Semgrep rules derived from the OWASP Mobile Application Security Testing Guide (MASTG) specifically for Android applications. The aim is to enhance and support Mobile Application Penetration Testing (MAPT) activities conducted by the ethical hacker community. The primary objective of these rules is to address the static tests outlined in the OWASP MASTG. Source: almost 2 years ago
For generally code analysis, I used Semgrep in the past. Source: over 2 years ago
You can try with Semgrep. For scanning shared drive you need to have the access though. Source: over 2 years ago
For these cases, let me introduce you to my favorite static code analysis tool: semgrep. It's a free Open Source tool that you can install and use right now (it only starts costing money if you want to use their dashboard to view the results, which is entirely optional, and all code scanning runs on your device - code is never uploaded to any servers). As stated briefly, semgrep searches for code matching specific... - Source: dev.to / over 2 years ago
I would probably start by seeing if I can use an existing tool to handle this for me. For example, I like using Comby and sometimes Semgrep for this sort of thing. Source: over 2 years ago
FWIW you can probably write a semgrep rule or something, to find all struct literals which don't mention a specific field. Source: almost 3 years ago
Do you know an article comparing Semgrep to other products?
Suggest a link to a post with product alternatives.
This is an informative page about Semgrep. You can review and discuss the product here. The primary details have not been verified within the last quarter, and they might be outdated. If you think we are missing something, please use the means on this page to comment or suggest changes. All reviews and comments are highly encouranged and appreciated as they help everyone in the community to make an informed choice. Please always be kind and objective when evaluating a product and sharing your opinion.
