semgrep
https://github.com/returntocorp/semgrep
OCaml
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Triage Issues!
When you volunteer to triage issues, you'll receive an email each day with a link to an open issue that needs help in this project. You'll also receive instructions on how to triage issues.
Triage Docs!
Receive a documented method or class from your favorite GitHub repos in your inbox every day. If you're really pro, receive undocumented methods or classes and supercharge your commit history.
OCaml not yet supported1 Subscribers
Add a CodeTriage badge to semgrep
Help out
- Issues
- Support Python 3.14 template string literals in the native parser
- feat(python): support native template string literals
- MCP safe_join fails to prevent directory escape on Windows, enabling arbitrary file write via create_temp_files_from_code_content`
- validate_local_files strips directory hierarchies to basenames, causing duplicate filenames across subdirectories to overwrite each other and drop from scans`
- git.clean_project_url fails to redact Personal Access Tokens and OAuth tokens from Git remote URLs without colons`
- read_config_at_path invokes loc.read_text() without specifying encoding, crashing with UnicodeDecodeError on UTF-8 rule files under default system encodings`
- C inline-assembly parser error
- Semgrep 1.177.0: engine provenance and taint-fixpoint behavior
- Windows Smart App Control blocks unsigned semgrep-core.exe - is an Authenticode-signed build available?
- golang type switch does not match
- Docs
- OCaml not yet supported