📦 semgrep / semgrep
⭐ 12,128 (+11)
🗒 OCaml
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
⭐ 12,128 (+11)
🗒 OCaml
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
GitHub - semgrep/semgrep: Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code. - semgrep/semgrep
github.com
July 25, 2025 at 6:02 PM
🚀 Semgrep: OCaml-Powered Code Analysis 🔍
Semgrep is a fast, open-source static analysis tool, written in OCaml, that supports over 30 programming languages. Trusted by companies like Dropbox and Snowflake, it has performed over 75 million scans across millions of projects.
👉 Semgrep.dev
Semgrep | Homepage
Semgrep.dev
December 2, 2024 at 2:05 PM
🚀 Semgrep: OCaml-Powered Code Analysis 🔍
Semgrep is a fast, open-source static analysis tool, written in OCaml, that supports over 30 programming languages. Trusted by companies like Dropbox and Snowflake, it has performed over 75 million scans across millions of projects.
👉 Semgrep.dev
SemGrep has migrated to OCaml 5 with negligible performance impact.
semgrep.dev/blog/2025/up...
They’ve had to do a bit of work to get a GC spacetime behaviour that matches OCaml 4. This feels like an issue with OCaml 5 GC scheduling. Needs investigation.
semgrep.dev/blog/2025/up...
They’ve had to do a bit of work to get a GC spacetime behaviour that matches OCaml 4. This feels like an issue with OCaml 5 GC scheduling. Needs investigation.
Semgrep | Upgrading Semgrep from OCaml 4 to OCaml 5
semgrep.dev
March 13, 2025 at 12:17 AM
SemGrep has migrated to OCaml 5 with negligible performance impact.
semgrep.dev/blog/2025/up...
They’ve had to do a bit of work to get a GC spacetime behaviour that matches OCaml 4. This feels like an issue with OCaml 5 GC scheduling. Needs investigation.
semgrep.dev/blog/2025/up...
They’ve had to do a bit of work to get a GC spacetime behaviour that matches OCaml 4. This feels like an issue with OCaml 5 GC scheduling. Needs investigation.
I whipped this together earlier today. It’s a Python script that generates a Semgrep rules list to check for non-inclusive language in code projects.
Uses word list from inclusivenaming.org
gitlab.com/SuperTeece/i...
Uses word list from inclusivenaming.org
gitlab.com/SuperTeece/i...
TC / Inclusive Language Semgrep Rules · GitLab
GitLab.com
gitlab.com
January 4, 2025 at 9:57 PM
I whipped this together earlier today. It’s a Python script that generates a Semgrep rules list to check for non-inclusive language in code projects.
Uses word list from inclusivenaming.org
gitlab.com/SuperTeece/i...
Uses word list from inclusivenaming.org
gitlab.com/SuperTeece/i...
god this is such a bad premise. these ads are grating and silly but they make sense to anyone who knows what the actual products are or has a need that the ad is speaking to. e.g. Brex is for corporate expense management (I've used it!), Semgrep is for vulnerability reporting, etc...
“When I reached out to Brex to try to understand what its ad meant, no one answered.”
The Year of Subway Slop
AI and nonsense ads trolled us on our commutes.
www.curbed.com
January 1, 2026 at 5:31 PM
god this is such a bad premise. these ads are grating and silly but they make sense to anyone who knows what the actual products are or has a need that the ad is speaking to. e.g. Brex is for corporate expense management (I've used it!), Semgrep is for vulnerability reporting, etc...
𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟲, 𝟮𝟬𝟮𝟲
Busy week! AI, AI, AI and the death of Flash!
🤖 𝗦𝗲𝗺𝗴𝗿𝗲𝗽'𝘀 𝗔𝗴𝗲𝗻𝘁 𝗦𝗸𝗶𝗹𝗹𝘀
Semgrep released a set of agent skills worth looking into: github.com/semgrep/skills.
Busy week! AI, AI, AI and the death of Flash!
🤖 𝗦𝗲𝗺𝗴𝗿𝗲𝗽'𝘀 𝗔𝗴𝗲𝗻𝘁 𝗦𝗸𝗶𝗹𝗹𝘀
Semgrep released a set of agent skills worth looking into: github.com/semgrep/skills.
GitHub - semgrep/skills: A collection of skills for AI coding agents from Semgrep
A collection of skills for AI coding agents from Semgrep - semgrep/skills
github.com
February 8, 2026 at 10:25 PM
𝗥𝗲𝘀𝗲𝗮𝗿𝗰𝗵 𝗪𝗼𝗿𝘁𝗵 𝗥𝗲𝗮𝗱𝗶𝗻𝗴 - 𝗪𝗲𝗲𝗸 𝟲, 𝟮𝟬𝟮𝟲
Busy week! AI, AI, AI and the death of Flash!
🤖 𝗦𝗲𝗺𝗴𝗿𝗲𝗽'𝘀 𝗔𝗴𝗲𝗻𝘁 𝗦𝗸𝗶𝗹𝗹𝘀
Semgrep released a set of agent skills worth looking into: github.com/semgrep/skills.
Busy week! AI, AI, AI and the death of Flash!
🤖 𝗦𝗲𝗺𝗴𝗿𝗲𝗽'𝘀 𝗔𝗴𝗲𝗻𝘁 𝗦𝗸𝗶𝗹𝗹𝘀
Semgrep released a set of agent skills worth looking into: github.com/semgrep/skills.
I had SO MUCH FUN last night at the @semgrep Paella cooking class last night!!!! 🥳
May 30, 2025 at 7:52 AM
I had SO MUCH FUN last night at the @semgrep Paella cooking class last night!!!! 🥳
I tried asking this on twitter, but was bombarded with unsolicited asks, but who would be interested in a workshop on how to author semgrep rules? I’ve gotten really good at it and want to teach people!
November 3, 2024 at 9:18 PM
I tried asking this on twitter, but was bombarded with unsolicited asks, but who would be interested in a workshop on how to author semgrep rules? I’ve gotten really good at it and want to teach people!
semgrep+gitleaksno
バイブコーディングが怖いので、全PJにSemgrep + gitleaksの自動セキュリティスキャンを仕込んだ話
zenn.dev
June 14, 2026 at 12:50 AM
semgrep+gitleaksno
After an amazing 2-year journey at @semgrep, it’s time for my next adventure.
I’m excited to share I’ll now be working for myself full-time, offering live secure coding and application security training to help teams write safer software.
Entrepreneurs gotta entrepreneur. 🚀
1/2
I’m excited to share I’ll now be working for myself full-time, offering live secure coding and application security training to help teams write safer software.
Entrepreneurs gotta entrepreneur. 🚀
1/2
August 13, 2025 at 8:44 PM
After an amazing 2-year journey at @semgrep, it’s time for my next adventure.
I’m excited to share I’ll now be working for myself full-time, offering live secure coding and application security training to help teams write safer software.
Entrepreneurs gotta entrepreneur. 🚀
1/2
I’m excited to share I’ll now be working for myself full-time, offering live secure coding and application security training to help teams write safer software.
Entrepreneurs gotta entrepreneur. 🚀
1/2
> We have been using OCaml 5 in production since the middle of February 2025, and the rollout has been entirely uneventful.
This was a highlight for me, after having worked to stress test it over the past ~3 years.
There are other nuggets in @semgrep.bsky.social's latest blog post though... 🤓
This was a highlight for me, after having worked to stress test it over the past ~3 years.
There are other nuggets in @semgrep.bsky.social's latest blog post though... 🤓
Semgrep | Upgrading Semgrep from OCaml 4 to OCaml 5
semgrep.dev
March 12, 2025 at 8:25 PM
> We have been using OCaml 5 in production since the middle of February 2025, and the rollout has been entirely uneventful.
This was a highlight for me, after having worked to stress test it over the past ~3 years.
There are other nuggets in @semgrep.bsky.social's latest blog post though... 🤓
This was a highlight for me, after having worked to stress test it over the past ~3 years.
There are other nuggets in @semgrep.bsky.social's latest blog post though... 🤓
I interviewed the most charming security professional I know, Laura Bell Main, about secure coding, AppSec, teaching, and gardening on my latest Semgrep webinar. Oh my gosh she had me in a fit of giggles!
https://twp.ai/9PSKiJ
https://twp.ai/9PSKiJ
June 16, 2025 at 3:38 AM
I interviewed the most charming security professional I know, Laura Bell Main, about secure coding, AppSec, teaching, and gardening on my latest Semgrep webinar. Oh my gosh she had me in a fit of giggles!
https://twp.ai/9PSKiJ
https://twp.ai/9PSKiJ
Please welcome onboard @semgrep.com as a sponsor for BSides Leeds! 🎉
Semgrep specialises in code security, supporting you to catch, flag, and fix vulnerabilities and bugs as you work.
We're absolutely delighted they're involved with this year's event — thank you so much for your support!
Semgrep specialises in code security, supporting you to catch, flag, and fix vulnerabilities and bugs as you work.
We're absolutely delighted they're involved with this year's event — thank you so much for your support!
May 26, 2026 at 9:01 AM
Please welcome onboard @semgrep.com as a sponsor for BSides Leeds! 🎉
Semgrep specialises in code security, supporting you to catch, flag, and fix vulnerabilities and bugs as you work.
We're absolutely delighted they're involved with this year's event — thank you so much for your support!
Semgrep specialises in code security, supporting you to catch, flag, and fix vulnerabilities and bugs as you work.
We're absolutely delighted they're involved with this year's event — thank you so much for your support!
During the weekend, I’ve been working a bit on updating my battle-tested #semgrep ruleset for #c #vulnerability research
https://github.com/0xdea/semgrep-rules
Nothing major, just a couple of small updates. It feels good to be back doing some #security #research! Let’s see where this takes me…
https://github.com/0xdea/semgrep-rules
Nothing major, just a couple of small updates. It feels good to be back doing some #security #research! Let’s see where this takes me…
GitHub - 0xdea/semgrep-rules: A collection of my Semgrep rules to facilitate vulnerability research.
A collection of my Semgrep rules to facilitate vulnerability research. - 0xdea/semgrep-rules
github.com
May 19, 2025 at 10:49 AM
During the weekend, I’ve been working a bit on updating my battle-tested #semgrep ruleset for #c #vulnerability research
https://github.com/0xdea/semgrep-rules
Nothing major, just a couple of small updates. It feels good to be back doing some #security #research! Let’s see where this takes me…
https://github.com/0xdea/semgrep-rules
Nothing major, just a couple of small updates. It feels good to be back doing some #security #research! Let’s see where this takes me…
Hello Semgrep!!
November 19, 2024 at 10:11 PM
Hello Semgrep!!
could you write semgrep to do this? maybe, but then you are spending hours making sure you're getting the semgrep expression correct, and then you still have to do the mechanical conversions, I for one welcome our parrot overlords here. It's less toil to have them do the work, AND
September 7, 2026 at 5:26 AM
could you write semgrep to do this? maybe, but then you are spending hours making sure you're getting the semgrep expression correct, and then you still have to do the mechanical conversions, I for one welcome our parrot overlords here. It's less toil to have them do the work, AND
Vibe coding is fast. But AI generated code should never be treated as trusted code.
Secrets, malicious dependencies, weak auth, and prompt injection can slip into the workflow.
Here’s a practical security workflow: Gitleaks, Semgrep, dependency scanning, and more.
shorturl.at/ZKitm
#VibeCoding
Secrets, malicious dependencies, weak auth, and prompt injection can slip into the workflow.
Here’s a practical security workflow: Gitleaks, Semgrep, dependency scanning, and more.
shorturl.at/ZKitm
#VibeCoding
Securing the Vibe Coding Workflow: Practical Security Habits for AI-Assisted Developers
The Practical Security Checks I Added Before Trusting AI-Generated Code
shorturl.at
September 26, 2026 at 1:01 AM
Vibe coding is fast. But AI generated code should never be treated as trusted code.
Secrets, malicious dependencies, weak auth, and prompt injection can slip into the workflow.
Here’s a practical security workflow: Gitleaks, Semgrep, dependency scanning, and more.
shorturl.at/ZKitm
#VibeCoding
Secrets, malicious dependencies, weak auth, and prompt injection can slip into the workflow.
Here’s a practical security workflow: Gitleaks, Semgrep, dependency scanning, and more.
shorturl.at/ZKitm
#VibeCoding
🟢 Semgrep version 1.147.0 is live!
Check out all the details here👇
https://github.com/semgrep/semgrep/releases/tag/v1.147.0
Check out all the details here👇
https://github.com/semgrep/semgrep/releases/tag/v1.147.0
January 14, 2026 at 11:02 PM
🟢 Semgrep version 1.147.0 is live!
Check out all the details here👇
https://github.com/semgrep/semgrep/releases/tag/v1.147.0
Check out all the details here👇
https://github.com/semgrep/semgrep/releases/tag/v1.147.0
Announcement: New free course in Semgrep Academy!!!! Learn everything you ever wanted about Security Headers from Scott Helme and I in this one-hour, on-demand course! Please check it out, and tell your (nerdy) friends!
academy.semgrep.dev/...
academy.semgrep.dev/...
May 6, 2025 at 2:21 AM
Announcement: New free course in Semgrep Academy!!!! Learn everything you ever wanted about Security Headers from Scott Helme and I in this one-hour, on-demand course! Please check it out, and tell your (nerdy) friends!
academy.semgrep.dev/...
academy.semgrep.dev/...
I've been cooking such detection capability for a few years now and felt it was time we released it to the world to aide with detection of e-skimmers.
So we did and my code is now up for all to use
github.com/Santandersec...
So we did and my code is now up for all to use
github.com/Santandersec...
GitHub - Santandersecurityresearch/e-Skimming-Detection: Semgrep Rules for Detecting Magecart Skimmers and Obfuscated JavaScript
Semgrep Rules for Detecting Magecart Skimmers and Obfuscated JavaScript - Santandersecurityresearch/e-Skimming-Detection
github.com
January 24, 2025 at 1:09 PM
I've been cooking such detection capability for a few years now and felt it was time we released it to the world to aide with detection of e-skimmers.
So we did and my code is now up for all to use
github.com/Santandersec...
So we did and my code is now up for all to use
github.com/Santandersec...
GitHub - uehaj/jev-semgrep: grep by meaning, across languages. TypeSafe Jev scores every line against a meaning; combine meanings with AND/OR/NOT. 意味で探す grep。日本語で英語を、英語で日本語を検索できる
https://github.com/uehaj/jev-semgrep
https://github.com/uehaj/jev-semgrep
GitHub - uehaj/jev-semgrep: grep by meaning, across languages. TypeSafe Jev scores every line against a meaning; combine meanings with AND/OR/NOT. 意味で探す grep。日本語で英語を、英語で日本語を検索できる
grep by meaning, across languages. TypeSafe Jev scores every line against a meaning; combine meanings with AND/OR/NOT. 意味で探す grep。日本語で英語を、英語で日本語を検索できる - uehaj/jev-semgrep
github.com
September 19, 2026 at 4:07 PM
GitHub - uehaj/jev-semgrep: grep by meaning, across languages. TypeSafe Jev scores every line against a meaning; combine meanings with AND/OR/NOT. 意味で探す grep。日本語で英語を、英語で日本語を検索できる
https://github.com/uehaj/jev-semgrep
https://github.com/uehaj/jev-semgrep
🟠 Semgrep is reporting a Partial Outage since 19:24 UTC
"Interruption to Scans and Accessing Web App"
Affects: Dashboard, API, Managed Scans
Live timeline → https://pingoru.io/providers/semgrep/incidents/11511122
#Semgrep #SemgrepDown
"Interruption to Scans and Accessing Web App"
Affects: Dashboard, API, Managed Scans
Live timeline → https://pingoru.io/providers/semgrep/incidents/11511122
#Semgrep #SemgrepDown
September 22, 2026 at 7:30 PM
🟠 Semgrep is reporting a Partial Outage since 19:24 UTC
"Interruption to Scans and Accessing Web App"
Affects: Dashboard, API, Managed Scans
Live timeline → https://pingoru.io/providers/semgrep/incidents/11511122
#Semgrep #SemgrepDown
"Interruption to Scans and Accessing Web App"
Affects: Dashboard, API, Managed Scans
Live timeline → https://pingoru.io/providers/semgrep/incidents/11511122
#Semgrep #SemgrepDown
At the Semgrep Roadshow, me being silly
September 19, 2023 at 9:11 PM
At the Semgrep Roadshow, me being silly