Semgrep · Blogs

Blogs listings from Semgrep on TechiSeek. 282 public listings.

• DEF CON 27 workshop on finding vulnerabilities at scale (Semgrep)
  A few weeks ago we hosted our first DEF CON workshop. We’re grateful we had the opportunity to share some of our work with a packed room, a…
• Why AI-Powered Memories are the Future of SAST (Semgrep)
  Over the past few years I've spent a lot of time thinking about SAST. Partially because I love static analysis.
• Not just another Jira integration (Semgrep)
  For security teams that rely on Jira, work just got a whole lot easier (for both security folks and the developers they partner with).
• Preventing SQL injection: a Django author's perspective (Semgrep)
  This is a guest post co-authored by Jacob Kaplan-Moss, co-creator of Django, and Grayson Hardaway.
• Silicon Valley Cyber Security: Detect complex code patterns using semantic grep (Semgrep)
  Many thanks to the Silicon Valley Cyber Security Meetup for inviting us to present at their virtual event “Talkin’ Security” on April 9 th.
• TanStack Router Packages Hit by Mini Shai-Hulud TheBeautifulSandsOfTime Supply Chain Attack (Semgrep)
  Malicious TanStack Router packages provide updated Mini Shai-Hulud style worm attack with encrypted exfil of credentials and dead man's swi…
• So the first malicious MCP server has been found on npm, what does this mean for MCP security? (Semgrep)
  The first confirmed malicious Model-Context-Protocol (MCP) server, postmark-mcp, was discovered on npm.
• Semgrep x Cursor: Introducing Cursor Plugins (Semgrep)
  Everything you need for secure code generation, now in one click.
• Semgrep Community Edition Fall Release 2025 (Semgrep)
  Semgrep Community Edition is an open source engine and security rules that can perform static code analysis to detect vulnerabilities.
• Speedrunning SHA pinning for GitHub Actions org-wide (Semgrep)
  How we pinned every GitHub Action across an org after the tj-actions/changed-files compromise, plus what to avoid.
• Semgrep now supports Cairo 1.0 (Semgrep)
  Announcing Semgrep's support for Cairo 1.0 - a language used to develop smart contracts. Our rockstar community user Romain Jufer writes ab…
• Efficient Dependency Management: Leveraging Manifest Files, Lockfiles, and SemVer Specifications (Semgrep)
  Evaluating Software Supply Chain (SCA) dependencies with a plan for manifests, lockfiles, & semver to prioritize direct & transitive depend…
• r2c's Series B funding (Semgrep)
  Most security tools don't put the developer first, and that's a problem we want to solve at r2 c.
• Bay Area OWASP Meetup presentation (Semgrep)
  A big thanks to the Bay Area OWASP Meetup for inviting us to present at their “Hacker Days” event on May 22 nd.
• Finding Python ReDoS bugs at scale using Dlint and r2c (Semgrep)
  Re DoS stands for regular expression denial-of-service. Re DoS bugs occur when a specially crafted string is passed to an inefficient regul…
• Semgrep's Fall 2021 Updates (Semgrep)
  Semgrep 0.70 supports taint-sanitizer-sink rules for smarter data-flow based scanning, parsing Terraform files to cover more infrastructure…
• Guardrails for PromQL using Semgrep (Semgrep)
  Michael Hoffmann is a Site Reliability Engineer at Aiven, working on all things logs and metrics.
• The best free, open-source supply-chain security tool? The lockfile (updated 2026) (Semgrep)
  tl;dr: Lockfiles often protect you from malicious new versions of dependencies. When something bad happens, they empower you to know exactl…
• Series D announcement (Semgrep)
  I'm delighted to announce we’ve raised a Series D, led by Menlo Ventures with participation from existing investors Felicis Ventures, Harpo…
• Engage your champions (Semgrep)
  In the previous article, ‘Recruiting Security Champions', we covered several ways to find, attract and recruit people to your cause.
• Using AI to write secure code with Semgrep (Semgrep)
  At Semgrep, we're passionate about finding and fixing security issues in code. When GPT was released, we jumped to experiment with it; we a…
• AI Can Do More Than Build Web Apps: What Hardware Hacking Teaches Us About LLM Capabilities (Semgrep)
  AI coding is often limited to web apps, but its real power extends further.
• BSides Las Vegas: the power of guardrails (Semgrep)
  In this BSides Las Vegas talk, r2 c security researchers Colleen Dai and Grayson Hardaway present a study on the effectiveness of secure gu…
• What You Should Know About Dependency Reachability in SCA (Semgrep)
  Explore how different levels of reachability analysis impact vulnerability accuracy in Software Composition Analysis.
• You Can't Reverse Engineer Your Way Out of the AI Supply Chain Problem (Semgrep)
  Backdoors in AI models are nearly undetectable today. Learn why provenance and independent auditing need to become industry standards, not…
• Getting Ready for Mythos with Semgrep (Semgrep)
  Mythos is poised to give attackers an unprecedented advantage, but Semgrep can help you restore the balance in your favor.
• Improving ReDoS detection and finding more bugs using Dlint and r2c (Semgrep)
  get this check now in Bento: $ pip3 install bento-cli && bento init Before getting started, if you haven’t seen the first post in this seri…
• Semgrep’s VS Code extension: powerful SAST as fast as linting (Semgrep)
  Semgrep is a code analysis tool many use for static application security scanning (SAST). SAST tools can be difficult to set up and use and…
• Bento 0.8: Updated workflows and new specialty checks (Semgrep)
  In Bento 0.8, we’ve significantly reduced its file footprint and tuned its default behavior for individual use, rather than something that…
• Security Should Be the Path of Least Resistance (Semgrep)
  Security often creates friction that frustrates developers and users, this can actually make systems less secure because when security is d…
• Building an enterprise-ready, scalable security program using Semgrep (Semgrep)
  Building a scalable, production-ready security program that detects issues in an application’s code can be incredibly challenging.
• DevSecOps worst practices – the series (Semgrep)
  Quite often when we read best practices we are told ‘what’ to do, but not the ‘why’. When we are told to ensure there are no false positive…
• "I wanted the big name on my resume": Why our former interns chose a startup anyway (Semgrep)
  We asked eight former Semgrep interns why they chose a startup internship over a big name, what they shipped, and where they are now.
• Will there be more security engineers in the future, or fewer? (Semgrep)
  It’s clear that the security practices designed for the era of 100% human-written code are rapidly becoming obsolete in a world where the v…
• How we made Semgrep rules run on Semgrep rules (Semgrep)
  We’ve been running Semgrep on Semgrep source code for a while, but what about scanning Semgrep rules?
• Security scanning with Semgrep in CI (Semgrep)
  Semgrep is improving every day; whether it's pushing new features to the Semgrep App, writing rules to support new languages, or cutting do…
• Our quest to make world-class security and bugfinding available to all developers, for free (Semgrep)
  by Isaac Evans, CEO and co-founder @ r2 c Why we’re building One thing we’ve learned at r2 c is that most Python or Java Script developers…
• Protect your code from the Polyfill supply chain attack (Semgrep)
  Over 100k websites use a CDN service, polyfill.io, that was delivering malicious JavaScript code.
• What Happens to Your AppSec Program When Going from Zero to 60k Lines of Code a Day (Semgrep)
  AI coding agents can generate 60,000 lines of code a day. See how AppSec teams are rethinking CI scanning, shift-left, and autofix to keep…
• The Future of SaaS Security: AI-Driven, Fast, and Secure (Semgrep)
  The SaaS industry thrives on speed—continuous releases, rapid innovation, and aggressive go-to-market strategies.
• How to prevent HTML email injection in Python web apps (Semgrep)
  tl;dr: - HTML injection is a vulnerability in which attacker-provided input is rendered as HTML.
• Pain-free custom linting: why I moved from ESLint and Bandit to Semgrep (Semgrep)
  tldr: Semgrep is an analysis tool that is easy to learn and easy to prototype rules with, and can be adopted across languages.
• So it's your first time at Hacker Summer Camp, and you want to make the most of it (Semgrep)
  Heading to Vegas for BlackHat, BSides, and DEF CON? A first-timer's guide to picking your conferences, packing smart, and pacing yourself.
• Security scanning at ludicrous speed (Semgrep)
  Semgrep is known for its developer-friendly and customizable nature in securing code. This velocity is crucial for seamless integration int…
• Why Engineers Are Switching to Codex (Semgrep)
  Developers are switching to OpenAI's Codex from Claude Code and Cursor, and Semgrep Guardian now secures what it writes too.
• Shift Right? After 20 Years of Shift Left? (Semgrep)
  Why AI-generated code and cheap attacker tooling make shift-right analysis a defender's problem.
• The tech behind Semgrep Assistant’s triage and remediation guidance (Semgrep)
  Semgrep Assistant is like having another median-level security engineer on your team, whose sole responsibility is parsing through findings…
• Introducing Semgrep’s Community-Oriented Twitter Account (Semgrep)
  The Semgrep Community team has some exciting news to share! We’re shaking things up in the best way possible, because we want to give you t…
• Axios Supply Chain Incident: Indicators of Compromise (Semgrep)
  Axios, the very popular HTTP client library, was compromised for three hours on March 30 th.
• Help us rename Semgrep OSS! (Semgrep)
  We're exploring new names for Semgrep OSS and we want the community's input - please fill out the linked survey by November 15th, and read…