timsonner Semgrep
Purpose
Use this skill when source code is available and the methodology benefits from white-box validation or faster hypothesis generation.
Phase Fit
- Primary: Vulnerability Analysis
- Secondary: Threat Modeling and Test Planning, Retest and Closure
Use When
- Need to review code patterns tied to authentication, authorization, input handling, or secrets.
- Need to validate whether a runtime issue is likely reachable in code.
- Need to retest a remediation by verifying the code path changed as intended.
Avoid When
- No source code or build context is available.
- Rule output would be reported without human review and reachability analysis.
Inputs
- Source tree, language, and framework context
- Relevant rule sets and excluded generated code
- Targeted hypotheses from runtime or architecture review
Procedure
- Scope the review to relevant languages and reachable components.
- Run only rule sets that match the current hypotheses.
- Triage matches for false positives, dead code, and non-reachable patterns.
- Correlate material matches with runtime behavior or architecture.
- Translate confirmed issues into code-aware remediation guidance.
Command Syntax
Replace sample paths with the approved source tree.
# Auto-detect best rules for the codebase
semgrep --config auto src/
# Scan with OWASP Top 10 ruleset
semgrep --config p/owasp-top-ten /path/to/contoso-webapp/
# Security audit ruleset
semgrep --config p/security-audit /path/to/contoso-webapp/
# Secrets detection
semgrep --config p/secrets /path/to/contoso-webapp/
# Output to SARIF for integration with security tooling
semgrep --config p/owasp-top-ten /path/to/contoso-webapp/ --sarif --output contoso-semgrep.sarif
# Run multiple rulesets
semgrep --config p/owasp-top-ten --config p/secrets /path/to/contoso-webapp/
# Exclude paths
semgrep --config p/owasp-top-ten /path/to/contoso-webapp/ --exclude='node_modules' --exclude='*.test.js'
Evidence to Capture
- File and function context for confirmed risky patterns
- Reachability notes that justify severity
- Code changes to verify during retest
Safety Boundaries
- Do not equate pattern matches with exploitable findings automatically.
- Exclude generated, vendored, or out-of-scope code from conclusions.