#semgrep

Ideally, when it comes to building secure applications, it’s best to check the code as it moves through the development process, so that vulnerabilities can be found before it gets into production. That’s exactly the kind of solution that Semgrep, formerly r2c, a San Francisco startup, has been building over the last five years. Today, the company announced it has raised a $53 million Series C.…

在 Hacker News Daily 上看到「Semgrep」這個軟體，看名字本來還以為是 semantic grep，結果是個靜態分析工具： Static analysis at ludicrous speed Find bugs and enforce code standards 專案是用 Python 寫的，可以直接用 pip install semgrep 裝起來，然後直接下指令掃，像是在自己的專案裡面執行，這邊用的 ruleset 是 r2c-ci： semgrep --config=p/ci . 官方網站上的截圖看起來也整的不錯： 可以自己跑或是掛進 CI 裡面跑…