semgrep
https://github.com/returntocorp/semgrep
OCaml
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
OCaml not yet supported1 Subscribers
Add a CodeTriage badge to semgrep
Help out
- Issues
- test: cover --test failure modes end to end
- fix(deps): bump mcp to 1.30.0 and OpenTelemetry to 1.45.1/0.66b1
- fix: match dict patterns against dict targets with unpacking
- fix: handle dotted and concatenated keys in Python mapping patterns
- fix: match expression patterns against type-switch cases in Go
- fix: use clean value for fused C string literal metavar content
- TypeScript parser skips the rest of the file when a regex literal contains "<!--"
- Pro (interfile, Java): a call into a nested class declared later in the file, or through a field, is not resolved, so a sanitizing callee is still reported
- Java: taint on a nested field is lost through a getter chain `b.getInner().getVal()` (CE and Pro), and renaming the getters makes CE find it
- Taint: flows are silently dropped once a function holds more than 50 tainted variables (taint_MAX_TAINTED_VARS), and the limit is not documented
- Docs
- OCaml not yet supported