Semgrep · Blogs

Blogs listings from Semgrep on TechiSeek. 282 public listings.

• London calling: Highlights from the 2025 cloud & cyber security expo (Semgrep)
  The 2025 Cloud & Cyber Security Expo recently concluded its two-day event, showcasing insightful discussions, innovative perspectives and a…
• Boosting Security Scan Performance for Monorepos with Multicore Parallel Processing (Semgrep)
  For security scans on a monorepos, memory management is critical to effective program analysis.
• Beyond Benchmarks: How Semgrep Redefines Javascript Security (Semgrep)
  Semgrep’s latest JavaScript analysis has found real vulnerabilities in open-source projects, going beyond traditional benchmarks to find hi…
• Benchmarking Semgrep Community Edition Performance Improvements (Semgrep)
  Semgrep Community Edition is free open-source software that provides static code analysis (SAST) at speeds that allow development teams to…
• Beyond vulnerabilities: Detect malicious dependencies in your supply chain (Semgrep)
  Semgrep Supply Chain now includes malicious dependency detection to further protect your code.
• From Gatekeepers to Guardrails: Automating Your PCI DSS v4.0.1 Strategy (Semgrep)
  Discover how to automate PCI v4.0.1 controls from Targeted Risk Analysis (TRA) to Reachability, using Policy-as-Code.
• Why SAST tools need to be customizable to be useful (Semgrep)
  Most modern SAST tools only provide findings, with no control or visibility into why or how they were surfaced.
• Semgrep × Cursor Hooks: Making Security Reliable for Agents (Semgrep)
  With Cursor hooks, AppSec teams can guarantee that all code generated by AI is scanned with Semgrep - without introducing any friction to d…
• Finding More Zero Days Through Variant Analysis (Semgrep)
  Eugene Lim demonstrates how to analyze through a root cause analysis a CVE and write Semgrep rules to catch variations.
• Can LLMs Detect IDORs? Understanding the Boundaries of AI Reasoning (Semgrep)
  Exploring how well LLMs and AI coding agents detect security flaws like IDOR, comparing sonnet and codex models for accuracy.
• 5 Ways SAST and SCA help fintech companies innovate securely (Semgrep)
  Semgrep empowers Fintech companies with fast, developer-first security tools, that reduce false positives and enable scalable, compliant in…
• Imagine zero false positive SAST (Semgrep)
  With Assistant Memories, Semgrep can reason about your code like a seasoned developer who's been on the team for years.
• How we built an AppSec AI that security researchers agree with 96% of the time (Semgrep)
  Getting Semgrep Assistant to triage vulnerabilities with a 96% true positive accuracy was hard, but there were lots of learnings along the…
• Detect Open Source Malware Attacks with Semgrep Supply Chain (Semgrep)
  Malicious dependency detection is now generally available for Semgrep Supply Chain customers.
• Security Alert (Semgrep)
  A cryptostealer malware was pushed to a number of npm packages including debug, chalk, duckdb, and a number of utility packages as a result…
• Enterprise Scale Code Scanning: Semgrep Managed Scans Crossed 1 MILLION Weekly Scans (Semgrep)
  Semgrep Managed Scans deploys enterprise SAST and SCA in minutes without the infrastructure headache.
• What it takes to make shift left work (Semgrep)
  The surface area of software is expanding at a rate well above our ability to secure it. How can we speed software delivery and prevent sec…
• Sha1-Hulud: The Second Coming of the NPM Worm is Digging For Secrets (Semgrep)
  In September incident responders were inundated with breaches all resulting from the npm supply chain.
• Fix What Matters, Faster: How Semgrep and Sysdig Are Unifying Security from Code to Runtime (Semgrep)
  In today’s cloud-native world, security teams face an impossible task: act faster, with fewer resources, in environments that change consta…
• Finding vulnerabilities in modern web apps using Claude Code and OpenAI Codex (Semgrep)
  Our deep dive into AI Coding Agents capabilities for finding security vulnerabilities reveals surprising strengths, critical weaknesses, an…
• Giving AppSec a Seat at the Vibe Coding Table (Semgrep)
  We're shipping something new: an open-source Model Context Protocol (MCP) for Semgrep that works with any IDE based MCP client, like Cursor.
• Five Considerations When Building Cross-Platform Tools for Windows and macOS (Semgrep)
  Semgrep is an open source security tool that has cross-platform support for Windows, macOS, and Linux.
• Code to cloud noise reduction - Prioritizing code security with Semgrep & Wiz (Semgrep)
  Traditional security operates in silos—Static Application Security Testing (SAST) tools identify issues in code, while Cloud-Native Applica…
• 7 Things We Learned from the EU’s Cybersecurity Threat Landscape 2050 Report (Semgrep)
  The EU's Cybersecurity Threat Landscape 2025 Report reveals crucial insights into how cyber threats are changing in Europe.
• New React2Shell Offspring Patched: React Server Components (DoS) and Source Code Exposure (Semgrep)
  Last week the React Blog released information about React2Shell which made many applications vulnerable to Unauthenticated Remote Code Exec…
• Remote Code Execution Security Bug in React Server Components Patched (Semgrep)
  A React Server Function vulnerability has been patched. Please update to the latest React, Next, React Router, Vite, etc.
• MCP: Model, Context… Propaganda? What security teams need to know about the latest hyped up AI tech (Semgrep)
  Model Context Protocol (MCP) is a new standard that allows Large Language Models (LLMs) to interact with external tools, moving AI beyond s…
• How Semgrep & StackHawk Help AppSec Teams Prioritize Real Risks (Semgrep)
  Finding vulnerabilities is not the problem anymore. Every code scan, pipeline, and dashboard produces more results than security teams can…
• Secrets Story: The Prefixed Secrets That Tried%20to%2BGet\nAway (Semgrep)
  Secret scanning tools often miss real leaked API keys and tokens. Learn why word boundaries and keyword rules cause false negatives—and how…
• Respond to Malware Incidents Faster with Advisory Impact Analysis in Semgrep Supply Chain (Semgrep)
  Semgrep Supply Chain’s advisory impact analysis helps AppSec quickly know if, and how, they’re affected by the latest supply chain attack.
• Maturing Your Application Security Program Survey (Semgrep)
  Want to Know How Mature Your AppSec Program Really Is?Take our expert-designed survey and receive a report with targeted guidance on how to…
• From idea to (secure) app: Semgrep + Replit (Semgrep)
  Over 30 million people use Replit to turn natural language into production ready code. Starting today, Replit Agent automatically uses Semg…
• 🚨 Popular GitHub Action tj-actions/changed-files is compromised (Semgrep)
  Popular GitHub Action tj-actions/changed-files has been compromised with a payload that appears to attempt to dump secrets, impacting thous…
• Forking Shai-Hulud: RedHat npm Packages Are The Next Victim After GitHub Actions Compromise and Worm (Semgrep)
  RedHat becomes the latest victim of an npm worm after a breach affected numerous packages in the @redhat-cloud-services npm organization.
• Fix today’s vulnerabilities and prevent tomorrow’s with secure guardrails (Semgrep)
  Spoiler alert: the developer experience (DevX) is paramount.
• We have Mythos at Home: GLM 5.2 beats Claude in our Cyber Benchmarks (Semgrep)
  Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.
• Three key learnings for AppSec teams from the XZ backdoor (Semgrep)
  It’s been a week since the XZ backdoor dropped. As the dust settles, it’s a good time for security teams to review the lessons it holds.
• Semgrep Code brings modern static analysis to C/C++ (Semgrep)
  Both languages are notoriously difficult for SAST tools to analyze accurately and quickly, but our Pro Engine is uniquely capable of handli…
• Take control of sensitive code without developer frustration (Semgrep)
  At Semgrep, we recognize that security of your software supply chain is critical — but it shouldn’t come at the cost of developer productiv…
• Easily create custom SAST guardrails with human language and Semgrep Assistant (AI) (Semgrep)
  Tell Semgrep Assistant about any organizational coding standards or best practices you want developers to implement - generated guidance wi…
• Choosing API Security Tools (Semgrep)
  Quite often clients ask me “Which API Security Tool should I buy?”, and as you might have guessed I answer “It depends”, then proceed to as…
• The Difference Between SCA and Supply Chain Security (Semgrep)
  Right now, the concept of the software supply chain and securing it is quite trendy.
• Understanding and mitigating the Log4Shell vulnerability (Semgrep)
  CVE-2021-44228, also known as Log4 Shell, is a remote code execution vulnerability in the Log4 j 2 library.
• Three things your linter shouldn’t tell you (Semgrep)
  Introducing Bento, a free and opinionated toolkit for easily adopting linters and program analysis in a codebase.
• Codebase-Aware Reachability Analysis Coverage for Rust (Semgrep)
  With the addition of reachability coverage for Rust, Semgrep now offers data-flow reachability analysis for 12 languages, reducing alert fa…
• Bringing Semgrep Managed Scanning to GitLab: automated code scanning at scale (Semgrep)
  Following the success of Semgrep Managed Scanning on GitHub, which runs Semgrep without any manual, per-repo CI/CD configuration, we are ex…
• Announcing Semgrep's experimental support of Swift (Semgrep)
  One of Semgrep’s design principles is to make static analysis possible for every programming language.
• Semgrep App's Fall 2021 updates (Semgrep)
  Semgrep App has been completely redesigned and now includes a drag-and-drop UI for configuring rules and notifications.
• Your Window of Exposure is the Attacker's Window of Opportunity (Semgrep)
  Supply chain attacks succeed in a short window after release. Learn how attackers exploit that gap and practical steps to reduce your expos…
• Should security engineers care about transitive supply chain vulnerabilities? (Semgrep)
  It's amusing to think that a developer can progress through years of crafting software, stitching together libraries and packages, all the…