#semgrep — Public Fediverse posts

RE: https://infosec.exchange/@hnsec/116923239649243702

My #Semgrep C/C++ ruleset is ready for prime time again!

Grab it before our new robot overlords take over the field of #VulnerabilityResearch entirely 🤖

Our Technical Director @raptor just shipped v2.0.0 of his #Semgrep C/C++ ruleset — now officially included in the @semgrep registry.

Marco built this ruleset back in 2022 to speed up C/C++ #VulnerabilityResearch, and it's since become a go-to reference, featured in several guides and toolkits.

This release brings new detections, fewer false positives, and better performance, all put to the test on real-world source code and binary firmware.

https://hnsecurity.it/blog/my-semgrep-c-cpp-ruleset-is-ready-for-prime-time-again/

Opengrep (open-source Semgrep-fork) in v1.24.0 released

https://secburg.com/posts/opengrep-v1240-released/

#Opengrep #SAST #AppSec #StaticAnalysis #OpenSource #semgrep

Semgrep: GLM 5.2 beats Claude in our Cyber Benchmarks

https://semgrep.dev/blog/2026/we-have-mythos-at-home-glm-52-beats-claude-in-our-cyber-benchmarks/

#HackerNews #Semgrep #GLM #CyberBenchmarks #AI #Claude

Semgrep is not a replacement for review. It is a cheap way to stop one bad pattern early.

I wrote a Quarkus walkthrough that builds a small document API, then blocks concatenated native queries in agent-generated Java with Semgrep, pre-commit, AGENTS.md, and CI.

https://www.the-main-thread.com/p/quarkus-semgrep-agent-security-guardrails

#Quarkus #Semgrep #JavaSecurity

28 Years Later: Some Things Changed. The Important Stuff Didn't.

Twenty-eight years after warning the U.S. Senate that the internet was broken, the security industry has grown but the core problem hasn't changed. We're still writing vulnerable code and patching after the fact. AI is both accelerating the risk and, for the first time, pointing at a real fix: security built into the developer's workflow, upstream, before the damage is done.

#Semgrep #l0pht

https://semgrep.dev/blog/2026/28-years-later-cybersecurity/

I was at the first #bsidessf however many years ago, I’ve missed a few but it’s good to be back. I’ll be walking around or chilling at the #Semgrep booth, come say hi.

Hey developers and vulnerability researchers!

I'm currently working on improving my #Semgrep ruleset for C/C++ static code analysis, and I've just published the new v1.1.0 release: https://github.com/0xdea/semgrep-rules

Some notable changes since the previous battle-tested release: new rules for detecting high-entropy assignments and ReDoS vulnerabilities, numerous enhancements to existing rules, reduced false positives without sacrificing coverage, optimized patterns across the board, and overall better documentation. Check the changelog for the full list (yes, there’s a changelog now).

Please test it inside and out, and feel free to open issues or submit pull requests. Your feedback is invaluable and will help shape the project roadmap. I'm aiming for a major release sometime before spring.

Как мы профукали базу клиента и научились безопасности

Больше восьми лет я работал backend‑разработчиком. Мы создавали веб‑приложения для автоматизации логистики и закупок. Команда росла, процессы крепли. Всё было правильно и красиво: CI/CD, код‑ревью, споры о чистоте архитектуры и идеальном нейминге. Мир был прост, предсказуем и казалось, что так будет всегда. Но однажды утром всё изменилось. Что же случилось?

https://habr.com/ru/articles/959542/

#semgrep #dfd #DREAD #stride #безопасная_разработка

I interviewed Kim Wuyts for a #Semgrep fireside chat called Privacy by Design: Making Threat Modeling Work for Data Protection, and it was super fun!

Watch us here: https://twp.ai/4ipiK6

@KimWuyts #privacy #threatmodeling

⏰ 2 days left! Submit your CtF level for a shot at $500 worth of Semgrep prizes at AppSec Village, @defcon 33.

Enter by Aug 3: https://appsecvillage.com/ctf

#defcon33 #ctf #semgrep #appsec #sponsors #win #challenge #capturetheflag

#Semgrep static analysis tool for #code scanning at ludicrous speed 🔍

🔍 Supports 30+ languages including #Python #JavaScript #Java #Go #C #Rust #TypeScript #php and more

🛡️ Finds bugs, enforces #security guardrails and coding standards with semantic pattern matching

⚡ Runs locally by default - code never uploaded, works in #IDE, pre-commit hooks & #CI/CD workflows

🤖 #AI-powered #SemgrepAssistant provides intelligent triaging and step-by-step remediation guidance

🧵 👇

I interviewed Kim Wuyts for a #Semgrep fireside chat called Privacy by Design: Making Threat Modeling Work for Data Protection, and it was super fun!

Watch us here: https://twp.ai/4inxqU

@KimWuyts #privacy #threatmodeling

I interviewed Kim Wuyts for a #Semgrep fireside chat called Privacy by Design: Making Threat Modeling Work for Data Protection, and it was super fun!

Watch us here: https://twp.ai/4io15f

@KimWuyts #privacy #threatmodeling

GitLab CI-CD semgrep SAST (Static Application Security Test) configuration example; blocks the MR if there is any finding.

https://gitlab.com/carvilsi/sast-cicd-example

#CI_CD #sast #semgrep #gitlab #security #devops

Current status:

#yaml #semgrep

One static analysis tool tells me to use `lstat` and `fstat` to avoid (or at least detect) malicious replacement of a file that I `open`. Then, after doing this, my other static analysis tool complains that I’ve introduced a TOCTOU (time-of-use, time-of-check) between `lstat` and `open`.

Sure, but I’m going to detect that. Real issue I have with all of this is that there’s still a window (which I estimate to be the about the same size in both versions of this program) between creating this pseudoterminal file and the next interaction I have with it (be that pulling file stats with `lstat` or `open`ing it).
#SemGrep #Coverity #StaticAnalysis #Programming #C

During the weekend, I’ve been working a bit on updating my battle-tested #semgrep ruleset for #c #vulnerability research

https://github.com/0xdea/semgrep-rules

Nothing major, just a couple of small updates. It feels good to be back doing some #security #research! Let’s see where this takes me…

SonarQube в действии: плагины как ключевой элемент контроля качества в отделе

Привет! Меня зовут Глеб, я старший backend-разработчик в ЮMoney. В прошлом году моя команда активно занималась внедрением и развитием инфраструктуры статического анализа на базе SonarQube . Итогом нашей деятельности стало превращение SonarQube из простого статического анализатора в полноценную платформу для автоматизации многих процессов контроля качества — от сопровождения кодовой базы и отказа от Kotlin до проверки обратной совместимости в OpenAPI-спецификациях и миграциях баз данных. Расскажу, какое место занимает этот инструмент в нашей системе контроля качества и как именно мы этого добились.

https://habr.com/ru/companies/yoomoney/articles/905900/

#sonarqube #статический_анализ #плагины #backendразработка #контроль_качества_кода #java #semgrep

Will you be at #RSAC or #BSidessf this year? Want to meet up with me? I've posted my schedule, with links so you can sign up for the free events. I'm also giving away 300 copies of my new book at the #Semgrep booth. It would be really nice to see you!

https://shehackspurple.ca/2025/04/17/my-schedule-at-rsac-2025/

Will you be at #RSAC or #BSidessf this year? Want to meet up with me? I've posted my schedule, with links so you can sign up for the free events. I'm also giving away 300 copies of my new book at the #Semgrep booth. It would be really nice to see you!

https://shehackspurple.ca/2025/04/17/my-schedule-at-rsac-2025/

Will you be at #RSAC or #BSidessf this year? Want to meet up with me? I've posted my schedule, with links so you can sign up for the free events. I'm also giving away 300 copies of my new book at the #Semgrep booth. It would be really nice to see you!

https://shehackspurple.ca/2025/04/17/my-schedule-at-rsac-2025/

Will you be at #RSAC or #BSidessf this year? Want to meet up with me? I've posted my schedule, with links so you can sign up for the free events. I'm also giving away 300 copies of my new book at the #Semgrep booth. It would be really nice to see you!

https://shehackspurple.ca/2025/04/17/my-schedule-at-rsac-2025/

Что помогает разработчику писать безопасный код: обзор инструментов

Современное производство программного обеспечения — сложный процесс, от разработчика требуется не только писать код, но и справляться с целым комплексом сопутствующих задач: отслеживать изменения, проводить тестирование, соблюдать стилистические правила и внутренние стандарты, учитывать безопасность и применять best practices по обеспечению ИБ уже во время написания кода. Но есть и хорошие новости. Разработчику доступно большое число инструментов, которые упрощают труд: от линтеров до анализаторов и систем автоматизированного тестирования — все они встраиваются в среду разработки и помогают решать сложные задачи, не отвлекаясь от творческой части работы. В этой статье я, Евгений Иляхин, архитектор процессов безопасной разработки в Positive Technologies, как раз расскажу о крайне полезных инструментах, которые автоматизируют рутину и повышают качество кода, позволяя программисту сосредоточиться на разработке новой фичи или поиске оптимального решения. Читать

https://habr.com/ru/companies/pt/articles/891400/

#безопасная_разработка #appsec #devsecops #sonarlint #semgrep #gitleaks #gitsecret #trivy #secret_scanner #owasp_zap

Current status: learning about #semgrep https://semgrep.dev/ for a personal project 🚀 .

For this case we need a quick and extensible code-scanning solution, that can process large code repositories in a reasonable amount of time and can be enhanced with custom rules. For a few years we're using #Semgrep for this use-case.

Better Code Scanning? Putting #Opengrep to the Test 🧐

Part of consistently improving our #pentesting procedures includes evaluating the tools we use in our assessments. When conducting code-reviews and pentests of fat-client applications we are often faced with the challenge of identifying vulnerabilities in the targets source code. 🧵

#AppSec #CyberSecurity #InfoSec #Hacking #CodeReview #SourceCode #Semgrep

Semgrep Raises $100M for AI-Powered Code Security Platform https://www.securityweek.com/semgrep-raises-100m-for-ai-powered-code-security-platform/ #ApplicationSecurity #MenloVentures #Funding/M&A #Opengrep #Semgrep

"We’re launching #Opengrep a fork of SemgrepCS (formerly SemgrepOSS), in response to recent changes by #Semgrep that affect its open-source nature and shift focus to its paid offering, limiting access and innovation for the broader community."

https://www.opengrep.dev/
https://github.com/opengrep/opengrep

OpenGrep sounds like a very interesting community initiative. I really hope this will get traction. The community needs open source tools without licensing pain.
Semgrep has been a great tool and it was just too disappointing to see it go pay walled with time.
#opengrep #semgrep
https://www.opengrep.dev/