Package: semgrep
Code scanning at ludicrous speed.This repository contains the source code for Semgrep OSS (open-source software). Semgrep OSS is a fast, open-source, static analysis tool for searching code, finding bugs, and enforcing code standards at editor, commit, and CI time. Semgrep is a semantic grep for code: wheregrep "2"would only match the exact string2, Semgrep wouldmatchx = 1; y = x + 1when searching for2. And it does this in 30+ languages! Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs: read more below.For companies who need SAST, SCA, and Secret scanning, we provide a product suite on top of Semgrep OSS that scans code and package dependencies for known issues, software vulnerabilities, and finds secrets with high accuracy:Semgrep Codeto find bugs & vulnerabilities using the deeper, interfile-analysis enabledPro engineand high-accuracy Pro rules in addition to the community rulesSemgrep Supply Chainto find dependencies with known vulnerabilities function-level reachability analysisSemgrep Secretsto find hard-coded credentials that shouldn't be checked into source codeSemgrep analyzes code locally on your computer or in your build environment:by default, code is never uploaded.Get started →.Language supportSemgrep Code supports 30+ languages.CategoryLanguagesGAC# · Go · Java · JavaScript · JSX · JSON · PHP · Python · Ruby · Scala · Terraform · TypeScript · TSXBetaKotlin · RustExperimentalBash · C · C++ · Clojure · Dart · Dockerfile · Elixir · HTML · Julia · Jsonnet · Lisp · Lua · OCaml · R · Scheme · Solidity · Swift · YAML · XML · Generic (ERB, Jinja, etc.)Semgrep Supply Chain supports 8 languages across 15 package managers.CategoryLanguagesGAGo (Go modules,go mod) · Javascript/Typescript (npm, Yarn, Yarn 2, Yarn 3, pnpm) · Python (pip, pip-tool, Pipenv, Poetry) · Ruby (RubyGems) · Java (Gradle, Maven)BetaC# (NuGet)Lock file-onlyRust (Cargo) · PHP (Composer)For more information, visit oursupported languagespage.Getting started 🚀From the Semgrep Cloud PlatformFrom the CLIFor new users, we recommend starting with theSemgrep Cloud Platformbecause it provides a visual interface, a demo project, result triaging and exploration workflows, and makes setup in CI/CD fast. Scans are still local and code isn't uploaded. Alternatively, you can also start with the CLI and navigate the terminal output to run one-off searches.Option 1: Getting started from the Semgrep Cloud Platform (Recommended)Register onsemgrep.devExplore the demo findings to learn how Semgrep worksScan your project by navigating toProjects > Scan New Project > Run scan in CISelect your version control system and follow the onboarding steps to add your project. After this setup, Semgrep will scan your project after every pull request.[Optional] If you want to run Semgrep locally, follow the steps in the CLI section.Notes:If there are any issues,please ask for help in the Semgrep Slack.Option 2: Getting started from the CLIInstall Semgrep CLI# For macOS
$ brew install semgrep

# For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep

# To try Semgrep without installation run via Docker
$ docker run -it -v "${PWD}:/src" semgrep/semgrep semgrep login
$ docker run -e SEMGREP_APP_TOKEN=<TOKEN> --rm -v "${PWD}:/src" semgrep/semgrep semgrep ciRunsemgrep loginto create your account and login to Semgrep.Logging into Semgrep gets you access to:Semgrep Supply Chain: A dependency scanner that detects reachable vulnerabilities in third party librariesSemgrep Code's Pro rules: 600+ high confidence rules written by Semgrep's security research teamSemgrep Code's Pro engine: An advanced code analysis engine, designed to detect complex vulnerabilities, and reduce false positivesGo to your app's root directory and runsemgrep ci. This will scan your project to check for vulnerabilities in your source code and its dependencies.Try writing your own query interactively with-e. For example, a check for Python == where the left and right hand sides are the same (potentially a bug):$ semgrep -e '$X == $X' --lang=py path/to/srcSemgrep EcosystemThe Semgrep ecosystem includes the following products:Semgrep Code- Scan your code with Semgrep's proprietary rules (written by our Security Research team) using our cross-file and cross-function analysis. Designed to find OWASP Top 10 vulnerabilities and protect against critical security risks. Semgrep Code is available on bothfree and paid tiers.Semgrep Supply Chain (SSC)- A high-signal dependency scanner that detects reachable vulnerabilities in open source third-party libraries and functions across the software development life cycle (SDLC). Semgrep Supply Chain is available on bothfree and paid tiers.Semgrep Secrets [NEW!]- Secrets detection that uses semantic analysis, improved entropy analysis, and validation together to accurately detect sensitive credentials in developer workflows.Book a demoto request early access to the product.Semgrep Cloud Platform (SCP)- Deploy, manage, and monitor Semgrep at scale, withfree and paid tiers. Integrates with continuous integration (CI) providers such as GitHub, GitLab, CircleCI, and more.Semgrep OSS Engine- The open-source engine and community-contributed rules at the heart of everything (this project).To learn more about Semgrep, visit:Semgrep Playground- An online interactive tool for writing and sharing rules.Semgrep Registry- 2,000+ community-driven rules covering security, correctness, and dependency vulnerabilities.Join hundreds of thousands of other developers and security engineers already using Semgrep at companies like GitLab, Dropbox, Slack, Figma, Shopify, HashiCorp, Snowflake, and Trail of Bits.Semgrep is developed and commercially supported bySemgrep, Inc., a software security company.Semgrep RulesSemgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Pythonprint()statements.Run it online in Semgrep’s Playground byclicking here.ExamplesVisitDocs > Rule examplesfor use cases and ideas.Use caseSemgrep ruleBan dangerous APIsPrevent use of execSearch routes and authenticationExtract Spring routesEnforce the use secure defaultsSecurely set Flask cookiesTainted data flowing into sinksExpressJS dataflow into sandbox.runEnforce project best-practicesUse assertEqual for == checks,Always check subprocess callsCodify project-specific knowledgeVerify transactions before making themAudit security hotspotsFinding XSS in Apache Airflow,Hardcoded credentialsAudit configuration filesFind S3 ARN usesMigrate from deprecated APIsDES is deprecated,Deprecated Flask APIs,Deprecated Bokeh APIsApply automatic fixesUse listenAndServeTLSExtensionsVisitDocs > Extensionsto learn about using Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!DocumentationBrowse the full Semgrepdocumentation on the website. If you’re new to Semgrep, check outDocs > Getting startedor theinteractive tutorial.MetricsUsing remote configuration from theRegistry(like--config=p/ci) reports pseudonymous rule metrics to semgrep.dev.Using configs from local files (like--config=xyz.yml) doesnotenable metrics.To disable Registry rule metrics, use--metrics=off.The Semgrepprivacy policydescribes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.MoreFrequently asked questions (FAQs)ContributingBuild instructions for developersAsk questions in the Semgrep community SlackCLI reference and exit codesSemgrep YouTube channelLicense (LGPL-2.1)UpgradingTo upgrade, run the command below associated with how you installed Semgrep:# Using Homebrew$brewupgradesemgrep# Using pip$python3-mpipinstall--upgradesemgrep# Using Docker$dockerpullsemgrep/semgrep:latest