Semgrep
- Category
- Infrastructure and DevOps
- Docs outline
- 12 sections
Official docs outline
semgrep.dev- Introduction to Semgrep
What Semgrep covers: SAST, SCA, and secrets, and how it analyzes code without executing it.
- How Semgrep works
Pattern matching engine, languages, and the difference between CE and AppSec Platform.
- Running local CLI scans
semgrep scan, --config, registry rules, output formats, and exit codes.
- Rule structure syntax
YAML rule fields: id, message, severity, languages, patterns, pattern-either, and metadata.
- Pattern syntax
Ellipsis operator, metavariables, deep expression matching, and typed metavariables.
- Dataflow analysis
Constant propagation and intraprocedural dataflow used by Semgrep rules.
- Taint analysis
Sources, sinks, sanitizers, and propagators in taint-mode rules.
- Testing rules
Annotated test files with ruleid and ok comments and running semgrep --test.
- Semgrep in CI
Running semgrep ci, diff-aware scanning, and sample pipeline configurations.
- Findings in CI and triage
Tracking findings across commits, baselines, and resolving or ignoring them in pull requests.
- Supply Chain (SCA)
Dependency vulnerability scanning with reachability analysis and license policies.
- Semgrep Secrets
Secrets rules with validators that check whether a detected credential is live.
Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.
