Vasilii Ermilov

Senior Security Researcher @semgrep

[Drew Dennison @drewdennison]

Agents have created two new surfaces we use can secure code. Also, we finally can shift left...all the way before the code hits the file system

[Drew Dennison @drewdennison]

.@semgrep is excited to benchmark, enable for all coding models, and contribute a great roadmap of improvements to our fork of @AnthropicAI's reference architecture for defending code. Code security is too important and we must all unite under open source. Builders wanted.

[Drew Dennison @drewdennison]

Just finished an experiment using @claude Opus 4.7 xhigh on a popular open source C/C++ repo from a top tech company:

- @cramforce's excellent deepsec: does not support C/C++
- A random gist with a code security prompt: 1 critical, 3 high vulnerabilities for $18.09
- Semgrep's new Mandoline tool in "hunt" mode: 3 critical unauthenticated RCE, 15 high, 20 medium, 11 low, a persistent threat model, and a full security report: $7.13

Responsibly reported to the repo owner. Will share details on the vulnerabilities when public

[Luke O'Malley @dlukeomalley]

There has been some confusion and misinformation circulating about the recent changes to Semgrep Community Edition. I want to clarify what is, and isn’t, changing. The Semgrep engine license remains LGPL 2.1.

Link in 🧵

[Semgrep @semgrep]

Happy December, everyone! 🎄🎅

We’re kicking off the month with an exciting lineup of webinars! Check out whats coming up:

🗓️ December 3, 9AM PT: Adaptive Noise Canceling Meets Code Scanning.
👉 RSVP: https://t.co/OzAJW7fkjD

🗓️ December 5, 9AM PT: How to Swim in The Ocean of SCA.
👉 RSVP: https://t.co/aPDlLxjbvc

🗓️ December 6, 9AM PT: Founder Friday: re:Invent Reflections and AI Predictions.
👉 RSVP: https://t.co/aaTPXGOsj9

🗓️ December 13, 9AM PT: FireSide Chat: Burning Down Organizational Risk.
👉 RSVP: https://t.co/PtoKjvX8Qf

🎉 Don’t miss out—let’s make December unforgettable!

#appsec #sast #supplychain #cybersecurity #ai #devops

[Semgrep @semgrep]

🎉 Big news: @semgrep made the 2025 #Cyber60 List by @FortuneMagazine & @lightspeedvp ! This honor highlights our mission to profoundly improve software security and reliability—and it’s all thanks to our incredible team pushing the boundaries every day.

🚀Huge shoutout to everyone at Semgrep! Check out the full list: https://t.co/IOBgBhzHaR

#appsec #semgrep #security

[Semgrep @semgrep]

🚀 Big news for Python devs! Semgrep Code’s latest update brings supercharged Python support with new framework-specific analysis. Now track implicit data flows in Django, FastAPI, Flask, and more!

Check out how we're making Python code safer: https://t.co/kPXPAnwzb1

[Semgrep @semgrep]

🚨 CONTEST ALERT! 🚨

Want to win 1 of 3 decks of 'Cards Against AppSec' by Tanya Janca? Simply RT this post and make sure you're following us to enter! ⏳ You have 48 hours—good luck!

#AppSec #Giveaway #CardsAgainstAppSec

[Vasilii Ermilov @ermil0v]

@LewisArdern 🙏

[Vasilii Ermilov @ermil0v]

I’ll be speaking at BSides Singapore on September 20!

[BSides Singapore @BSidesSG]

Catch Vasilii Ermilov @ermil0v as he dives into "Most Common Vulnerabilities in GitHub Actions: Takeaways from Mass Scanning GitHub Repositories for Bounties."

📅 Sept 20, 2024
📍 Lifelong Learning Institute, SG

[Aptos Labs @AptosLabs]

Security researchers and developers, @semgrep now supports Move on @Aptos with an initial set of security rules.

Learn how to get started, report bugs, and help secure the Aptos ecosystem ⤵️
https://t.co/SxkvSPMHvD

[Semgrep @semgrep]

We’re excited to share our updated Jira integration! Developers now get AI-generated remediation steps in tickets, making fixing issues easy.

Semgrep can now auto-create tickets from high-priority issues, reducing overhead for tracking and triage.

More: https://t.co/rJUpm8Ku1k

[elttam @elttam]

New blog post and tool release: plORMbing your Prisma ORM with Time-based Attacks

https://t.co/DfUfQR1yJq and
https://t.co/eHlEWIRJWc

[Semgrep @semgrep]

🚀 Exciting news! Introducing Semgrep Academy: your FREE ticket to mastering AppSec and more! 💻 Enroll now in our on-demand courses and elevate your skills!

https://t.co/RsqOTdiVzd

#SemgrepAcademy #FreeCourses #FreeAppSecCourses #Certification #AppSecCertification

[Semgrep @semgrep]

What started as an April Fools joke turned into a great demo of Semgrep’s extensibility and scalability when it comes to adding support for new languages.

Check out more about our GA support for CodeQL’s query language in @onefiftyman’s blog post:

https://t.co/jARqn6Qg8N

[Vasilii Ermilov @ermil0v]

Semgrep now supports C/C++ 🎉

https://t.co/KZQl1w7ONf

[JS0N Haddix @Jhaddix]

One of my "secret" techniques for code analysis in bug bounty (mostly parsing code leaked on GitHub) is manual semantic analysis, not just regex.

I'm SUPER hyped @semgrep has added this to their flow.

Check out the full blog on using it in the 2nd tweet below.

[Semgrep @semgrep]

📢 The Secret’s out! We’re thrilled to share that Semgrep Secrets is available for Public Beta today! Secrets leverages Semantic Analysis in addition to regex and entropy-based validation to detect secrets with high precision.

Learn more → https://t.co/1yZ4jsw3cP

[Pieter De Cremer @0xDC0DE]

@BSidesMunich 👜 Bring your own code and I will help you write Semgrep rules, live at the workshop!

✍ Sign up for my workshop on October 14 if you are interested.

https://t.co/4aaN6w79oH

[Nasdaq Exchange @NasdaqExchange]

.@semgrep is on a mission to improve software security and reliability.

In partnership with @Redpoint, Semgrep CTO & Co-Founder Drew Dennison shares how Semgrep uses its code scanning platform for finding first and third-party security vulnerabilities in code bases.