Semgrep Reviews and Details

Is Semgrep good?

Social recommendations and mentions

• Best DevSecOps Security Tools for CI/CD Pipeline Protection

  Representative tools: Semgrep is my default — it's open-source, fast, and its rules read like the code they match, so writing a custom rule for your own footguns takes minutes. GitLab ships a built-in SAST analyzer you can enable with a single include in your .gitlab-ci.yml. For Python-specific work, Bandit is a lightweight option. - Source: dev.to / about 1 month ago

• 7 Free Tools for Testing AI-Generated Code Before It Ships

  Semgrep is a static analysis tool that works across multiple languages and focuses specifically on security-relevant patterns. Where ESLint is general-purpose, Semgrep is built for finding the kinds of code patterns that lead to vulnerabilities. - Source: dev.to / 3 months ago

• 7 Tools That Help You Review and Validate AI-Generated Code in Your Pipeline

  Semgrep is an open-source static analysis tool that supports custom rules. For AI-generated code, it is particularly useful for enforcing patterns that ESLint and mypy don't cover: business logic rules, security patterns, or project-specific conventions. - Source: dev.to / 3 months ago

• 7 Free Tools for Managing AI Code Output in Production Engineering Teams

  Semgrep runs static analysis using rules that match code patterns across many languages. For AI-generated code specifically, it's useful for catching common hallucination patterns: calls to deprecated API methods, uses of removed library functions, or security antipatterns that appear in training data because they were widespread in code before security guidance was widely adopted. - Source: dev.to / 3 months ago

• How to Build a Code Quality Gate for AI-Assisted Pull Requests

  For Python projects, add Semgrep alongside flake8 or pylint. Semgrep's community rules include checks for common AI-generated patterns like deprecated API usage and security antipatterns. The configuration is minimal:. - Source: dev.to / 3 months ago

• Automating Zero-Day Discovery in Windows Kernel Drivers with LangChain DeepAgents

  Custom rules using Semgrep scan the decompiled C for patterns that look like known vulnerabilities. Things like MmMapIoSpace with user-controlled args, memcpy with user-controlled length, METHOD_NEITHER without ProbeForRead, that kind of thing. - Source: dev.to / 3 months ago

• Why AI-Generated Code Passes Tests But Fails in Production

  Static analysis tools catch some of these issues automatically. Semgrep can detect common concurrency anti-patterns. SonarQube tracks complexity that correlates with error-handling gaps. ESLint catches missing error handling in promise chains. But automated analysis catches surface patterns, not semantic correctness. - Source: dev.to / 3 months ago

• 5 Open Source Linters and Static Analysis Tools for AI-Assisted Codebases

  Semgrep is a multi-language static analysis tool with pattern-matching rules that look similar to the code they match. The free tier includes the full engine and access to the community rule registry, which has thousands of rules covering security, correctness, and best practices for most major languages. - Source: dev.to / 3 months ago

• How to Set Up Semgrep GitHub Action for Code Scanning

  Sign up at semgrep.dev using your GitHub account. Create an organization that corresponds to your GitHub organization. Navigate to Settings and generate an API token. This token authenticates your CI scans and enables PR comments, finding management, and the web dashboard. - Source: dev.to / 4 months ago

• How to Write Custom Semgrep Rules: Complete Tutorial

  For teams already committed to the Semgrep ecosystem, the Semgrep Cloud platform offers 20,000+ Pro rules maintained by professional security researchers. The platform is free for up to 10 contributors and costs $35 per contributor per month on the Team plan. See our Semgrep pricing breakdown for details. - Source: dev.to / 4 months ago

• How to Set Up Semgrep in 2026 - Complete Installation and Configuration Guide

  Go to semgrep.dev and sign up with your GitHub, GitLab, or email account. - Source: dev.to / 4 months ago

• What makes Developer Experience World-Class?

  Lint your code. Do so early. Add security linters (like bandit or semgrep). - Source: dev.to / 7 months ago

• 🚀 Vibe Coding Mistakes (When Using AI Tools) and How to Avoid Them

  Semgrep (2024) Semgrep Static Analysis [Tool]. Available at: https://semgrep.dev (Accessed: 12 January 2025). - Source: dev.to / 8 months ago

• A guide to using Graphite's stacked PRs for GitHub users

  If you're not sure how to take advantage of Graphite but your colleagues are raving about it, here's what I wish I was told from the beginning when we started experimenting with Graphite at Semgrep. I propose a workflow that makes it easy to revise previous commits, reduces conflicts, and avoids having unrelated changes in the same PR. - Source: dev.to / 10 months ago

• How to make “Input validation” easy for your devs

  Also, we can use a tool like Semgrep to audit the use of the middleware through all routes using a custom rule, to show a simple example we can use a rule like the below (Note this is just example which covers one way of defining routes in Express, for production the rule needs to be extended to include all other ways of defining routes). - Source: dev.to / almost 2 years ago

• Tree-Sitter

  > Not sure I understand your point. The problem is using Treesitter (for syntax highlighting and "semantic movements") and an LSP at the same time. So if your language has a LSP, using Treesitter additionally is redundant at best and introduces inconcistency at worst. I'm not talking about using Treesitter as the parser for the LSP. > Most popular languages have language-specific tools I'd say even less popular... - Source: Hacker News / over 2 years ago

• Powerful SAST project for Android Application Security

  This project is a compilation of Semgrep rules derived from the OWASP Mobile Application Security Testing Guide (MASTG) specifically for Android applications. The aim is to enhance and support Mobile Application Penetration Testing (MAPT) activities conducted by the ethical hacker community. The primary objective of these rules is to address the static tests outlined in the OWASP MASTG. Source: about 3 years ago

• Do you SecDevOps?

  For generally code analysis, I used Semgrep in the past. Source: over 3 years ago

• Username/password scanner for network share

  You can try with Semgrep. For scanning shared drive you need to have the access though. Source: over 3 years ago

• Spring Actuator - Finding Actuators using Static Code Analysis - Part 2

  For these cases, let me introduce you to my favorite static code analysis tool: semgrep. It's a free Open Source tool that you can install and use right now (it only starts costing money if you want to use their dashboard to view the results, which is entirely optional, and all code scanning runs on your device - code is never uploaded to any servers). As stated briefly, semgrep searches for code matching specific... - Source: dev.to / over 3 years ago

• How to approach modifying source code programmatically?

  I would probably start by seeing if I can use an existing tool to handle this for me. For example, I like using Comby and sometimes Semgrep for this sort of thing. Source: almost 4 years ago