Semgrep · Blogs

Blogs listings from Semgrep on TechiSeek. 282 public listings.

• Accelerate and Automate Remediation with Semgrep Autofix (Semgrep)
  Semgrep Autofix combines the world’s most popular static analysis engine with frontier-model LLMs to provide contextual upgrade guidance, l…
• Security Champions: Metrics & Data (Semgrep)
  The previous article in this series is Recognizing and Rewarding Your Security Champions. If you've followed my conference talks, you likel…
• Important updates to Semgrep OSS (Semgrep)
  We’re making updates to the Semgrep OSS engine and rules—now collectively named Semgrep Community Edition!
• Teaching security champions (Semgrep)
  In the previous article, we talked about how to engage your champions. We want them interested, revved up and ready to go.
• CocoaPods vulnerabilities highlight risks in dependency managers (Semgrep)
  Three critical vulnerabilities have been disclosed for the CocoaPods dependency manager. These vulnerabilities exposed more than 3 million…
• Using Bento individually and on team projects (Semgrep)
  With Bento release 0.8, we’ve tuned its default behavior for individual use, rather than something that requires team-wide adoption.
• AI & Cybersecurity: Learnings from three months of Semgrep Assistant (Semgrep)
  Semgrep Assistant helps application security teams by using AI to identify potential false positives and suggest code updates to fix bugs.
• Surprising subtleties of Docker permissions (Semgrep)
  The fundamental building block of our analysis platform is an analyzer. Since the static analysis world works in many different languages a…
• Attackers Can't Have All the Advantage: Introducing Semgrep Multimodal (Semgrep)
  Semgrep’s new detection capabilities have found multiple incident-level zero-days at customers, and have been credited with saving tens of…
• (Over)Communication with your security champions (Semgrep)
  As mentioned in the previous article (Recognizing and rewarding your security champions), the most common reason for failure of a security…
• Protect Your GitHub Actions with Semgrep (Semgrep)
  ❗ semgrep --config p/github-actions ❗ Demo repository for this post: https://github.com/minusworld-gha-demo/shell-injection.
• Exploit exploitability: prioritize supply chain findings with EPSS (Semgrep)
  EPSS is a powerful prioritization mechanism: when combined with Semgrep’s dataflow reachability analysis, EPSS enables you to deprioritize…
• It's time to ignore 98% of dependency alerts. Introducing Semgrep Supply Chain. (Semgrep)
  Let’s be honest: those of us that use a Software Composition Analysis (SCA) tool are already ignoring > 90% of its alerts.
• Upgrading Semgrep from OCaml 4 to OCaml 5 (Semgrep)
  We upgraded Semgrep from OCaml 4 to OCaml 5 and have open-sourced a garbage collector tuning utility that allowed us to make the upgrade wi…
• Bento 0.9: Checks for a high-severity Python vulnerability and Jinja templates (Semgrep)
  Bento version 0.9 includes a check that caught a high-severity Python vulnerability and also introduces a suite of checks for Jinja, Flask’…
• Introducing Semgrep and r2c (Semgrep)
  Free, fast, open-source, offline, customizable. These are not often words that describe code scanning tools, and that's a shame.
• Not all attacks are equal: understanding and preventing DoS in web applications (Semgrep)
  Thanks to Clint Gibler, Grayson Hardaway, and Pablo Estrada at r2 c for their contributions to this piece.
• Shoulda, Woulda...Coulda (Semgrep)
  In the world of SAST it’s very easy to spot two types of findings: - True positives: A confirmed vulnerability - False positives: Something…
• Dynamically Resolve Dependencies for a Full Picture of Your Inventory (Semgrep)
  Semgrep Supply Chain now includes Dynamic Dependency Resolution to provide a complete inventory of dependencies when lockfiles are absent,…
• Announcing Kotlin Reachability: Expanding the reach of Semgrep’s reachability (Semgrep)
  We’re excited to announce an exciting new feature in Semgrep’s software composition analysis (SCA) tool—Kotlin reachability.
• Semgrep chosen to be part of OpenAI’s Trusted Access for Cyber Program (Semgrep)
  Semgrep’s selection includes early access to frontier AI models with stronger cyber reasoning capabilities and grants to fund advancements…
• Announcing custom rules for Semgrep Secrets (Semgrep)
  Customers can now write their own rules for Semgrep Secrets!
• Comparing Semgrep Community Edition and Semgrep Code for Static Analysis Sensitivity (Semgrep)
  Doyensec shares a white paper of their security research findings comparing accuracy when identifying true and false positives between SAST…
• Be careful what you request for (Semgrep)
  HTTP Verbs Did you know that the HTTP verb in a request can be arbitrary? GET, POST, and their compatriots are so commonplace it's easy to…
• Software supply chain security is hard (Semgrep)
  Software Composition Analysis (SCA) tools are often noisy and create cross-team friction, yet we need them to manage the ever-increasing se…
• Tips and tricks for writing fixes (Semgrep)
  Developers have a lot on their plate, and security tools finding issues means even more work for them.
• HackerOne partners with Semgrep to combine expert code review with powerful automation (Semgrep)
  A long time ago, in a perfect world far, far away... developers could rely on a brilliant peer to review every code change quickly, while e…
• Keep your rules simple with symbolic propagation (Semgrep)
  Symbolic propagation is an experimental feature that enables Semgrep to perform matching modulo variable assignments, so you can keep rules…
• Semgrep: a static analysis journey (Semgrep)
  Semgrep (semantic grep) is a fast and lightweight static analysis tool to find bugs and enforce code standards.
• Cross-compiling OCaml to JS and Wasm: How we made the Semgrep Playground Fast (Semgrep)
  Semgrep is a fast, open source static analysis tool for finding bugs, detecting vulnerabilities in third-party dependencies, and enforcing…
• Hardcoded secrets, unverified tokens, and other common JWT mistakes (Semgrep)
  Hardcoded secrets, unverified tokens, and other common JWT mistakes Examining 2,000+ npm modules for common mistakes when using JWT Vasilii…
• Exploiting dynamic rendering engines to take control of web apps (Semgrep)
  tl;dr: - Dynamic rendering is a technique used to serve prerendered web site pages to crawlers (e.g., Google search engine, Slack or Twitte…
• Redefining security coverage for Python with framework-native analysis (Semgrep)
  We’ve supercharged Semgrep Code’s Python support with new, framework-specific analysis capabilities.
• What Application Security Actually Does All Day (Semgrep)
  Application security has a marketing problem. Here's what an AppSec team actually does all day, what it doesn't, and why the job got urgent.
• Fully loaded: testing vulnerable PyYAML versions (Semgrep)
  ❗ tl;dr: By testing the PyYAML API across various released versions, we determined that the yaml.Loader class is unsafe in all released ver…
• Summer of Semgrep: Our Hacker Summer Camp 2026 Guide (Semgrep)
  From shifting security right with AI to securing AI-generated code, here's Semgrep's full Hacker Summer Camp 2026 schedule across Black Hat…
• Less effort, more insight: Introducing Dependency Graph for Supply Chain (Semgrep)
  Introducing Semgrep’s Dependency Graph: effortless visibility into your software supply chain.
• Announcing Semgrep Code: SAST designed and built for engineers (Semgrep)
  Semgrep Code enables security teams to leverage the Semgrep Pro Engine and Pro rules to surface highly actionable vulnerabilities directly…
• Building security champions (Semgrep)
  There is a severe shortage of trained and experienced people who are capable of securing the systems that we must protect.
• New, high-signal rules for the JavaScript ecosystem (Semgrep)
  The Semgrep registry now has 3 fresh rulesets for the Java Script ecosystem: - We upgraded the p/javascript ruleset so that it is applicabl…
• Unlocking advanced security for all: Semgrep’s latest update (Semgrep)
  Introducing free access to Semgrep Supply Chain and Code’s Pro features, for up to 10 monthly contributors.
• The indomitable maintainer spirit versus the indifferent cruelty of JavaScript (Semgrep)
  The recent discontinuation of the JavaScript code virtualization tool “vm2” sounds the alarm for under-maintained open source packages.
• Bringing more Semgrep capabilities to BitBucket and Azure DevOps (Semgrep)
  We’re excited to announce the expansion of Semgrep's capabilities to include Atlassian BitBucket Cloud, BitBucket Data Center, and Microsof…
• The journey of a language from experimental to GA in Semgrep (Semgrep)
  Semgrep is a code analysis tool many use for application security scanning (SAST). One of the design principles that has guided Semgrep’s d…
• Announcing Ruby GA support (Semgrep)
  Semgrep v0.35.0 has promoted Ruby support from beta to generally available (GA)! Install or upgrade Semgrep and try out our latest Ruby rul…
• Experimental feature: generic pattern matching (Semgrep)
  Recently we added a new experimental feature to Semgrep: generic pattern matching. Generic pattern matching allows Semgrep to match code pa…
• Introducing Semgrep Custom Workflows (Semgrep)
  Operationalize AI alongside deterministic analysis to automate code security workflows you can build, test, and deploy at scale.
• Open Source Security: Chaos, Collaboration, and the Cost of “Free” (Semgrep)
  Open source powers almost everything we build, but when something goes wrong, the fallout is never contained.
• MCP Gives Agents Tools. Hooks Give Security Control. (Semgrep)
  MCP gives AI agents tools, but a scan the agent can skip isn't a control. See how Grok Build Hooks run Semgrep before the agent calls the w…
• Meet the Semgrep Interns: Four Projects from Summer 2026 (Semgrep)
  See what four software engineering interns built at Semgrep in 2026: autoscaling, Jira syncing, program analysis, and memory profiling.