Semgrep · Blogs

Blogs listings from Semgrep on TechiSeek. 282 public listings.

• Python static analysis comparison: Bandit vs Semgrep (Semgrep)
  Git Lab recently announced they are transitioning a majority Git Lab SAST analyzers to Semgrep!
• Bento check: Catch catastrophic backtracking ReDoS bugs (Semgrep)
  get this check now in Bento: $ pip3 install bento-cli && bento init Re DoS (regular expression denial-of-service) bugs occur when a special…
• Expanding Semgrep’s C# coverage of MSDN advisories with Go and Colly (Semgrep)
  How we made it easy to follow .NET coding best practices by scraping the MSDN documentation for recommendations and concerns.
• Introducing Semgrep Academy: the door to cyber security for everyone (Semgrep)
  It’s been my dream to share all of my content and knowledge for free, ever since I started learning about AppSec.
• The birth of Semgrep Pro Engine (Semgrep)
  Of all our projects, adding interfile analysis in a way that achieves our developer-focused goals without the aid of the open-source commun…
• You do not need to do DAST in a pipeline to do DevSecOps (Semgrep)
  The post also explains why DAST is not needed in your pipeline and encourages a tailored approach that fits an organization's unique needs…
• Driving enterprise adoption of AI code security with Semgrep Assistant (Semgrep)
  Semgrep Assistant saves developers and security engineers tens of thousands of hours annually.
• Security headers for ASP.Net and .Net CORE (Semgrep)
  For those who do not follow myself or Franziska Bühler, we have an open source project together called OWASP Dev Slop in which we explore D…
• Comparing Open-Source AI Code Security Harnesses (Semgrep)
  A guide to open-source AI tools for finding code vulnerabilities, comparing exploit generation, skill-boosted auditing, and SAST+LLM hybrid…
• My experience interning at r2c (Semgrep)
  a big-tech company has always been a huge dilemma for me throughout my college career. As both have pros and cons, it’s difficult to find t…
• A deep dive into Semgrep Supply Chain (Semgrep)
  Top level goal of an App Sec supply chain program Are you an App Sec engineer? Are you trying to minimize the mass exploitability of your a…
• Overrated and underperforming: transitive reachability analysis (Semgrep)
  Due to complex dependency layers and static analysis limitations, transitive reachability analysis struggles to deliver actionable insights.
• We put GPT-4 in Semgrep to point out false positives & fix code (Semgrep)
  Semgrep is a code search tool many use for security scanning (SAST). We added GPT-4 to our cloud service to ask which Semgrep findings matt…
• 28 Years Later: Why We're Still Losing the Cybersecurity Battle (Semgrep)
  After 28 years in cybersecurity, some things have changed — awareness is up, tools are better — but we're still writing vulnerable code and…
• Four levels of maturity that bridge the AppSec / engineering divide (Semgrep)
  This is a guest post authored by Jacob Kaplan-Moss, co-creator of Django. I came up as a web developer and helped create a popular web fram…
• Taint mode is now in beta (Semgrep)
  Using the flexibility of Semgrep patterns with taint mode to find injection vulnerabilities Iago Abal October 21 st, 2021 Note Taint mode i…
• Testing autofix behavior of SAST rules (Semgrep)
  It is very easy to write custom rules for Semgrep. And to ensure these rules keep functioning as expected, you can write automated tests.
• Recruiting security champions (Semgrep)
  In the previous article, ‘Building Security Champions', we covered what champions are, why you need them, and our plan to make an amazing p…
• Security Advisory (Semgrep)
  A new npm supply chain worm Shai-Hulud was designed to install and use secret scanning tools to exfiltrate tokens and keys and then repeat.
• Announcing C# alpha support (Semgrep)
  Semgrep v0.52.0 has promoted C# support from develop to alpha! This means that we expect to parse most C# code (our estimated parse rate is…
• Executable XSS cheat sheets for popular web frameworks (Semgrep)
  We’re big fans of the OWASP Cheat Sheet Series, one of the flagship OWASP projects. The series includes detailed information on all kinds o…
• Type-awareness in semantic grep (Semgrep)
  tl;dr: Semgrep now allows you to specify types in the code patterns you write, allowing you to find bugs and antipatterns or enforce best p…
• Comparing Reachability Analysis methods: Semgrep's distinct approach (Semgrep)
  What do people mean exactly when they use the term reachability? As it turns out, there are many distinct approaches to reachability analys…
• Securing CodeQL queries with Semgrep (Semgrep)
  We're excited to announce that Semgrep now offers GA support for CodeQL's query language.
• Writing Semgrep rules (Semgrep)
  There’s no one right way or process for writing a Semgrep rule. The following outlines a process many have found effective.
• Structure Mode: Never write an invalid Semgrep rule again (Semgrep)
  Semgrep rule-writing is simple in principle, but it can be easy to make mistakes in practice (especially if you are newer to rule-writing).
• Announcing Semgrep’s experimental support for Julia (Semgrep)
  With over 25 different languages supported, Semgrep has carved out a niche for itself as something of a polyglot static and software compos…
• My Very, Very, VERY HONEST Internship Experience @ Semgrep (Semgrep)
  I interned at Semgrep, an application security company. It reshaped my perspective, leaving me eager for a future in the dynamic field of c…
• Preventing secrets in source code (Semgrep)
  What we mean by secrets in application security, how to find secrets in your code with a secret scan, & preventing secrets from being leake…
• JavaScript static analysis comparison: ESLint vs Semgrep (Semgrep)
  As mentioned in our previous post comparing Semgrep and Bandit, Git Lab recently announced that they are transitioning a majority Git Lab S…
• Semgrep Quarterly Launch: scaling your AppSec impact just got easier (Semgrep)
  This quarter we've shipped a variety of features that make the Semgrep AppSec Platform easier to manage and scale across an organization -…
• Children of Shai-Hulud: An Analysis of the The Evolution, Delivery and Spread of the TanStack (Semgrep)
  The latest Shai-Hulud malware campaign weaponizes GitHub Actions, poisoned caches, IDE hooks, and dynamic infrastructure to spread across s…
• Rapidly deploy code scans across your organization with Semgrep managed scanning (Semgrep)
  You can now roll out Semgrep at ludicrous speed without any manual, per-repo CI/CD configuration.
• Through a Scanner Falsely: When AI-reported Critical Vulnerabilities Aren’t (Semgrep)
  The game is asymmetric; our teams are buried under alerts, dashboards, and ever expanding backlogs.
• Semgrep at Hella Secure HellaConf 2020 (Semgrep)
  Thanks to Hella Secure for hosting an outstanding virtual App Sec conference, #Hella Conf 2020!
• Appsec Development: Keeping it all together at scale (Semgrep)
  Appsec Development: Keeping it all together at scale Note: Clint Gibler helped in the brainstorming and editing of this post.
• Crypto is Fine. The Code is Not. (Semgrep)
  An analysis of cryptographic failures like improper verification of a cryptographic signature and use of a broken or risky algorithm.
• AI-Native vs. AI-Washed: How to Evaluate AppSec Tooling (Semgrep)
  Not every AI-native security tool is what it claims to be. Use these five vendor interview questions to cut through the hype and find tools…
• The OWASP API Security Top Ten: API1:2019 Broken Object Level Authorization (Semgrep)
  The following (10 part!) blog series will be on the OWASP API Security Top Ten, 2019 version.
• Attackers Are Still Coming for Security Companies. Here's Where We Stand. (Semgrep)
  The TeamPCP supply chain campaign that began with Trivy in March has now reached Checkmarx's Docker images, VS Code extensions, and Bitward…
• Fixing leaky logs: how to find a bug and ensure it never returns (Semgrep)
  I lay out a case for moving security enforcement into the hands of developers. I show how I and another developer at r2 c successfully iden…
• Enhancing developer happiness: The impact of identifying code-specific issues (Semgrep)
  The post explores various ways to customize rules, including through APIs, custom languages, and...
• 🤫 Don't leak your secrets (Semgrep)
  Semgrep users often ask about scanning code for secrets—passwords, API keys, Git Hub personal access tokens (PATs), etc.
• SF Python: writing robust Flask apps (Semgrep)
  It was super fun to be part of SF Python’s second virtual meetup on April 8 th, and we’re grateful to have had the opportunity to present a…
• Taming the elephant: Introducing reachability analysis for PHP (Semgrep)
  We're very excited to introduce the industry's first reachability analysis for PHP. One of the original languages used to power the web, PH…
• Announcing AI-assisted remediation guidance on every PR (Semgrep)
  Semgrep Assistant now offers high quality, step-by-step remediation guidance to developers on almost every true positive finding, resulting…
• Flask check: send_file() with a file handle (Semgrep)
  by Grayson Hardaway, Engineering @ r2 c Background At r2 c, our mission is to profoundly improve software security and reliability to safeg…
• Announcing Pyro Caml: The First Continuous Profiler for OCaml (Semgrep)
  Semgrep open-sources Pyro Caml 1.0.0, the first continuous profiler for OCaml. Learn how it uses Memprof, OCaml Runtime Events, and Pyrosco…
• Announcing Semgrep Supply Chain’s beta support for C# (Semgrep)
  Semgrep Supply Chain (Semgrep’s SCA product) can now find reachable vulnerabilities in C# dependencies.
• Semgrep, a code & supply chain security search engine, raises Series C (Semgrep)
  I'm excited to share that Semgrep (formerly r2 c) has raised $53 M in a Series C led by Lightspeed Venture Partners with Felicis, Redpoint,…