.@semgrep is excited to benchmark, enable for all coding models, and contribute a great roadmap of improvements to our fork of @AnthropicAI's reference architecture for defending code. Code security is too important and we must all unite under open source. Builders wanted.
Just finished an experiment using @claude Opus 4.7 xhigh on a popular open source C/C++ repo from a top tech company:
- @cramforce's excellent deepsec: does not support C/C++
- A random gist with a code security prompt: 1 critical, 3 high vulnerabilities for $18.09
- Semgrep's new Mandoline tool in "hunt" mode: 3 critical unauthenticated RCE, 15 high, 20 medium, 11 low, a persistent threat model, and a full security report: $7.13
Responsibly reported to the repo owner. Will share details on the vulnerabilities when public
There has been some confusion and misinformation circulating about the recent changes to Semgrep Community Edition. I want to clarify what is, and isn’t, changing. The Semgrep engine license remains LGPL 2.1.
Link in 🧵
Happy December, everyone! 🎄🎅
We’re kicking off the month with an exciting lineup of webinars! Check out whats coming up:
🗓️ December 3, 9AM PT: Adaptive Noise Canceling Meets Code Scanning.
👉 RSVP: https://t.co/OzAJW7fkjD
🗓️ December 5, 9AM PT: How to Swim in The Ocean of SCA.
👉 RSVP: https://t.co/aPDlLxjbvc
🗓️ December 6, 9AM PT: Founder Friday: re:Invent Reflections and AI Predictions.
👉 RSVP: https://t.co/aaTPXGOsj9
🗓️ December 13, 9AM PT: FireSide Chat: Burning Down Organizational Risk.
👉 RSVP: https://t.co/PtoKjvX8Qf
🎉 Don’t miss out—let’s make December unforgettable!
#appsec #sast #supplychain #cybersecurity #ai #devops
🎉 Big news: @semgrep made the 2025 #Cyber60 List by @FortuneMagazine & @lightspeedvp ! This honor highlights our mission to profoundly improve software security and reliability—and it’s all thanks to our incredible team pushing the boundaries every day.
🚀Huge shoutout to everyone at Semgrep! Check out the full list: https://t.co/IOBgBhzHaR
#appsec #semgrep #security
🚀 Big news for Python devs! Semgrep Code’s latest update brings supercharged Python support with new framework-specific analysis. Now track implicit data flows in Django, FastAPI, Flask, and more!
Check out how we're making Python code safer: https://t.co/kPXPAnwzb1
🚨 CONTEST ALERT! 🚨
Want to win 1 of 3 decks of 'Cards Against AppSec' by Tanya Janca? Simply RT this post and make sure you're following us to enter! ⏳ You have 48 hours—good luck!
#AppSec#Giveaway#CardsAgainstAppSec
Catch Vasilii Ermilov @ermil0v as he dives into "Most Common Vulnerabilities in GitHub Actions: Takeaways from Mass Scanning GitHub Repositories for Bounties."
📅 Sept 20, 2024
📍 Lifelong Learning Institute, SG
Security researchers and developers, @semgrep now supports Move on @Aptos with an initial set of security rules.
Learn how to get started, report bugs, and help secure the Aptos ecosystem ⤵️
https://t.co/SxkvSPMHvD
We’re excited to share our updated Jira integration! Developers now get AI-generated remediation steps in tickets, making fixing issues easy.
Semgrep can now auto-create tickets from high-priority issues, reducing overhead for tracking and triage.
More: https://t.co/rJUpm8Ku1k
What started as an April Fools joke turned into a great demo of Semgrep’s extensibility and scalability when it comes to adding support for new languages.
Check out more about our GA support for CodeQL’s query language in @onefiftyman’s blog post:
https://t.co/jARqn6Qg8N
One of my "secret" techniques for code analysis in bug bounty (mostly parsing code leaked on GitHub) is manual semantic analysis, not just regex.
I'm SUPER hyped @semgrep has added this to their flow.
Check out the full blog on using it in the 2nd tweet below.
📢 The Secret’s out! We’re thrilled to share that Semgrep Secrets is available for Public Beta today! Secrets leverages Semantic Analysis in addition to regex and entropy-based validation to detect secrets with high precision.
Learn more → https://t.co/1yZ4jsw3cP
@BSidesMunich 👜 Bring your own code and I will help you write Semgrep rules, live at the workshop!
✍ Sign up for my workshop on October 14 if you are interested.
https://t.co/4aaN6w79oH
.@semgrep is on a mission to improve software security and reliability.
In partnership with @Redpoint, Semgrep CTO & Co-Founder Drew Dennison shares how Semgrep uses its code scanning platform for finding first and third-party security vulnerabilities in code bases.