Secure · SAST
Semgrep
Semgrep is a lightweight SAST engine that matches code patterns across 30+ languages. It runs locally and in CI in minutes, with registry rulesets for OWASP categories, secrets and framework-specific issues.
On this page
What it does
Semgrep matches abstract-syntax patterns (“grep for code”) using rules written in YAML. The OSS engine performs intra-file analysis; the commercial product adds cross-file dataflow and a findings UI.
Where it fits
Secure stage on every merge request. Because a scan typically finishes in under a minute, it belongs in the fast-feedback loop, not a nightly.
Quick start
semgrep scan --config p/default --error
semgrep scan --config p/owasp-top-ten --config p/secrets --sarif --output semgrep.sarifCommon pitfalls
- Running without
--errormakes the job always pass. - Rulesets like
p/defaultchange over time; pin the CLI version and review new findings when it bumps. - Writing organisation rules is where the value is — generic rulesets rarely encode your real risks.
Articles about Semgrep
A GitLab CI/CD Security Pipeline That Developers Do Not Route Around
The GitLab pipeline that gated this site while it ran CI: frozen installs, parallel quality gates, Trivy with SAST and secret detection, artifact verification, and one deployment owner behind protected main.
Building a Secure CI/CD Pipeline with Jenkins
A declarative Jenkins pipeline with secrets scanning, SAST, image scanning and least-privilege credential handling — and the agent, plugin and Docker decisions that keep it that way.