Semgrep

Use it when

• run fast static analysis and security rules across a codebase
• write structural rules for unsafe patterns that regex cannot express reliably

What it solves

Not the fit when

• findings still require triage and project-specific rule tuning

Install

pip install semgrep

Invoke

semgrep scan --config auto

Alternatives

No reviewed alternatives recorded yet.