Tag

#semgrep

24 posts1 followers

Explore Hashnode

Alternatives

bo3d ago · 10 min read

What Pair Coding Actually Looks Like.

This is not a tutorial written after the fact. It is a record of a pair-coding session: I asked Claude Code to show me how to scan SkillTriage with Semgrep, and we worked through it together. The comm

bokaung.hashnode.dev

AngusKitOct 19 · 7 min read

Replace Semgrep, Trivy, and Gitleaks scripts with one scan gate

The merge request is green, then release is blocked by a secret or dependency CVE—usually because Semgrep, Trivy, and Gitleaks each own a job: three logs, three exit codes, no shared Finding, no share

anguskit.hashnode.dev

Lemon and GingerOct 15 · 8 min read

DevSecOps and AI - Part 2

AI introduces two new considerations for SAST - security vulnerabilities introduced by AI-generated code, and vulnerabilities specific to AI applications. AI-generated code has been reported to contai

cyberology101.hashnode.dev

Lemon and GingerOct 1 · 5 min read

DevSecOps and AI

Introduction DevSecOps is the practice of integrating security at every stage of the the software development lifecycle. In this series of posts, I will be exploring AI from a DevSecOps lens, focusing

cyberology101.hashnode.dev

Paul MKAug 17 · 7 min read

I wrote four Semgrep rules and never ran them. Two were broken.

I have a line I use a lot: a finding is a snapshot, a rule is a ratchet. Find a bug once and you've closed one instance. Write the rule and you've closed the class, including in code nobody will ever

paulappsec.hashnode.dev

DevTools GuideMar 4 · 5 min read

Semgrep: Find Real Bugs with Pattern-Based Static Analysis

Most linters catch style problems. Semgrep catches real bugs: SQL injection, hardcoded secrets, insecure deserialization, SSRF vulnerabilities, and misuse of cryptographic APIs. It works on source code using pattern matching that understands syntax —...

devtoolsguide.hashnode.dev

DevTools GuideMar 3 · 8 min read

Static Analysis Beyond Linting: CodeQL, Semgrep, SonarQube, and Snyk Code

Static Analysis Beyond Linting: CodeQL, Semgrep, SonarQube, and Snyk Code Linters enforce style. Static analysis finds bugs. The difference matters. ESLint will tell you about unused variables and inconsistent formatting. CodeQL will tell you that us...

devtoolsguide.hashnode.dev

GitHubOpenSourceDec 16, 2025 · 3 min read

Stop Supply Chain Attacks: GuardDog Scans Your Dependencies for Hidden Malware

📝 Quick Summary: GuardDog is a command-line interface tool designed to detect malicious packages across various ecosystems including PyPI, npm, Go, GitHub Actions, and VSCode extensions. It employs both source code analysis using Semgrep rules and p...

github-open-source.hashnode.dev

Hare Krishna RaiSep 4, 2025 · 5 min read

From Grep to Taint Analysis: The Evolution of Static Code Scanning

Static code analysis has come a long way from the days of simple string searches. With the rising complexity of applications and threats, our tooling has evolved to meet the demand for both precision and context-awareness. This blog takes you through...

blog.harekrishnarai.me

Hare Krishna RaiJun 21, 2025 · 18 min read

Introduction to Static Application Security Testing (SAST)

Introduction This is the first article in a 30-day series on Static Application Security Testing (SAST). We’ll introduce what SAST is and why it matters for building secure software. SAST refers to analyzing source code to find security vulnerabiliti...