Semgrep · Blogs

Blogs listings from Semgrep on TechiSeek. 282 public listings.

• Semgrep recognized in the 2025 Gartner® Magic Quadrant™ for Application Security Testing (Semgrep)
  For the first time, Semgrep has been recognized in the 2025 Gartner Magic Quadrant for Application Security Testing.
• Semgrep: Stop grepping code (Semgrep)
  tl;dr: Semgrep is an open-source tool that is like a code-aware grep: you can easily match all calls to a certain function, match all speci…
• Should random() be banned? (Semgrep)
  Thought experiment: should the use of non-cryptographically secure random() be flagged to developers (examples: Bandit and gosec)?
• Need for speed: static analysis version (Semgrep)
  TL;DR: Semgrep has achieved remarkably fast scan times by prioritizing speed using methods like taint summaries and tree matching in OCaml.
• Semgrep Fall '23 Launch: improved coverage + enterprise fit (Semgrep)
  Expanded language coverage, new enterprise features, and more This quarter, in addition to launching Semgrep Secrets, our team concentrated…
• Black Hat USA 2026: The Hacker Summer Camp Survival Guide (Semgrep)
  Heading to Black Hat USA 2026 at Mandalay Bay? Get the inside track on must-see briefings, Arsenal demos, Summits, and how to survive Hacke…
• Expanding Semgrep Supply Chain into Dependency Intelligence and License Compliance (Semgrep)
  With Semgrep Supply Chain, you can now mitigate supply chain vulnerabilities before a CVE even drops with Dependency Search and enforce you…
• The future of AppSec and why I joined r2c (Semgrep)
  Sometimes, it feels like things happen for a reason. After a series of unexpected events, I now find myself as Head of Security Research at…
• Developer-focused results and improved coverage with Semgrep Pro rules (Semgrep)
  Semgrep Pro rules are high confidence SAST rules that leverage the latest Semgrep features, and are designed to produce actionable results…
• New Sandbox Escape Affecting Popular nodejs Sandbox library vm2 (Semgrep)
  Popular Node.js sandboxing library vm2 has just announced a critical vulnerability in their library which allows attackers to bypass their…
• Announcing Semgrep’s support for Go in Pro Engine (Semgrep)
  We’re adding support for Go in our Pro Engine with 50+ new Go rules covering several popular Go frameworks!
• What a Hackathon Reveals About AI Agent Trends to Expect in 2026 (Semgrep)
  Hackathon projects reveal emerging AI agent trends for 2026, from MCP workflows to multi-LLM development, browser-based security, and IDE s…
• Recognizing and rewarding security champions (Semgrep)
  The previous article in this series is Teaching Security Champions. You may be wondering at this point if you accidentally clicked on an ar…
• Seattle Java User Group: Detect complex code patterns using Semgrep (Semgrep)
  In this talk, Kurt Boberg from Chegg and Daghan Altas from r2 c show how to use Semgrep to detect complex code patterns in Java, with a par…
• Bento check: keeping your cookies safe in Flask (Semgrep)
  get this check now in Bento: Get this check in Semgrep: brew install semgrep && \ semgrep --config "https://semgrep.dev/p/python-flask" !
• When DevSecOps goes wrong (Semgrep)
  There’s a trend to unify security and developer flows that goes by various names like Dev Sec Ops and “shift left.” Generally security team…
• Introducing Semgrep for GitLab (Semgrep)
  Semgrep now has 1 st-class integration into Git Lab through two paths: Git Lab SAST and Semgrep CI.
• Semgrep Spring 2022 meetup recap (Semgrep)
  We were thrilled to meet so many folks, from as far away as Germany and Sweden to as near as *ahem* San Francisco, at our Spring 2022 Meetu…
• The End Is Nigh for Code Review (Semgrep)
  At one company, PR volume tripled while reviewers grew 1.5x. AI code review has to check every change and send only the exceptions to human…
• AppSec guides, not gates: Introducing secure guardrails with Semgrep (Semgrep)
  "Shift left" was popular, but has largely failed to deliver on its promises. For too many teams, it was a way to take the same old security…
• Why We Hack Purple and I are joining Semgrep (Semgrep)
  Why I'm choosing Semgrep, and what the future will hold for the AppSec Community.
• How we resolved the ‘HTTP request failed: timeout’ issue in OCaml (Semgrep)
  The following is a guest post from Hannes Mehnert, a programmer at Robur, who has been helping translate the Semgrep OSS from Python to OCa…
• Sense and (path) sensitivity: My experience adding a new feature as a Semgrep intern (Semgrep)
  I spent 10 weeks at Semgrep as a Software Engineering (SWE) Intern on the Semgrep Analysis Foundations Team, the team that owns and maintai…
• Announcing general availability of C# (Semgrep)
  We’re very excited to announce that C# support is now generally available in Semgrep! Semgrep’s parse rate for C# is now over 99.9% and the…
• 10x your AppSec program with Semgrep Assistant (Semgrep)
  Assistant helps both AppSec engineers and developers make the correct decisions faster, with far less cognitive load required.
• Demystifying Taint Mode (Semgrep)
  With this knowledge you’ll be able to secure your codebase with confidence and panache! Semgrep has a couple of ways to analyze code for vu…
• Hackers Supply Chain Attack Moves From npm to PyPI as Trivy Breach Extends into LiteLLM Package (Semgrep)
  Analysis of the TeamPCP supply chain attack linking Trivy, GitHub Actions, npm, and LiteLLM, including how the credential stealer works and…
• Powerfully autofixing code with Semgrep's new AST-based approach (Semgrep)
  ❗ tl;dr: In this blog post, I explain why AST-based autofix is better than text-based autofix and how Semgrep implements AST-based autofix…
• Is AI-Generated Code Secure? Testing Claude Opus 5.5 (Semgrep)
  Claude Opus 5.5 wrote working code on 94% of 186 CVE tasks, but only 55% was secure. What memorization means for AI-generated code security.
• XML Security in Java (Semgrep)
  — Tl;dr: In this blog post, you can read just how much of a mess Java XML security is. If by the end of this post, you feel confident parsi…
• r2c meetup on writing Semgrep rules (Semgrep)
  Thanks to everyone who joined our meetup on writing Semgrep rules for security, correctness, and performance on August 26 th.
• A day in the life: Supply Chain Security Researcher (Semgrep)
  This will give a glimpse into what it is like to be a Security Researcher on the Semgrep Supply Chain Security Research team!
• Scanning Shell Scripts With Semgrep (Semgrep)
  Semgrep now has experimental support for Bash. This allows detecting problems in shell scripts when it would be hard or impossible with pla…
• Semgrep Supply Chain announces dataflow reachability support for 10 languages (Semgrep)
  Semgrep Supply Chain now supports Scala and Swift, which brings our dataflow reachability coverage up to 10 languages!
• Announcing Semgrep Code Search (public beta) (Semgrep)
  Semgrep Code Search lets users run a single rule across hundreds of code repositories in seconds, highlighting all instances of matching co…
• Does your LLM thing work? (& how we use promptfoo) (Semgrep)
  client.chat.completions.create: the most effective and least reliable four words I've written in my career in software.
• Choosing a static analysis tool (Semgrep)
  There is no one tool that is perfect for every organization, and if you have the wrong one it can create friction, delays, frustration, and…
• Why Do Worms Work (Semgrep)
  Supply chain worms keep compromising trusted npm packages by stealing maintainer credentials and letting automated pipelines spread malware…
• Security Regulations: From Scary Stories to Strategic Advantage (Semgrep)
  Security regulations don’t have to be scary. Learn how cybersecurity governance risk and compliance can become a strategic advantage for st…
• Security that Ships: The ROI of AppSec for Engineering Teams (Semgrep)
  Engineering teams that fix security findings in pull requests resolve them in 4.8 days vs.
• Announcing Semgrep's general availability support of PHP (Semgrep)
  We’re very excited to announce that PHP is now fully supported (that is, generally available) in Semgrep!
• The CVE program’s new rules: will they affect your vulnerability management? (Semgrep)
  The new CNA Rules v4.0 introduce more flexible, case-by-case CVE assignment guidelines, emphasizing a community-driven approach and potenti…
• Conclusion: Security Champions (Semgrep)
  In the previous article we talked about Metrics, and in this article, I will conclude this series on Building Security Champions.
• Write custom rules with the new Playground (Semgrep)
  Every organization has its own set of security challenges. Your security tolerance, technical infrastructure, and valuable data all factor…
• Client SDKs Can Be a Supply Chain Blind Spot (Semgrep)
  A compromised Telnyx Python SDK reveals a critical client SDK security gap in modern supply chain dependencies.
• r2c named Disruptive Innovator by Forbes (Semgrep)
  Just before the new year we received the great news that Forbes staff bestowed the award “Disruptive Innovator” to r2 c in the Forbes Cyber…
• AppSec in Pole Position: A Week of Customers, Conversations, and Code Security across EMEA (Semgrep)
  Two events, very different settings, but one clear signal from the security leaders and practitioners we spoke with: the intersection of AI…
• LSP.js: Using Wasm and JavaScript to support OCaml on Windows (Semgrep)
  Here at Semgrep, we make a super fast SAST tool that users can run locally from their command line.
• New insight into backlogs, developer engagement, and security posture (Semgrep)
  Semgrep’s revamped reporting capabilities bring increased levels of clarity to your production backlog, developer engagement levels, and ov…
• Announcing Semgrep’s beta support for Rust (Semgrep)
  Programming language, or cult following?