🧰 Semgrep

The items that name it 26

• Qwen3-Coder writes less secure code when told it's for a US persona
  articleas classification.technologies2026-10-21
• Chinese AI Model Writes More Hackable Code When Told It’s for US Contractor
  articleas classification.technologies2026-10-21
• Building your AI vulnerability harness, Part 1
  articleas tools2026-10-07

  Static scanner whose findings are fed through the AST gate and LLM exploitability classification during multi-scanner triage

• Top AI Coding Agent Security Resources — October 2026
  articleas tools2026-10-02

  Static analysis/scanning tool; missed nearly half of trojanized hook-update samples in testing

• Shor
  repoas tools2026-09-19

  White-box static analysis: source code scanning

• 0sec-labs/0
  repoas tools2026-08-19

  Integration via plugins/MCP for static analysis/security scanning

• SecureAI-Scan
  repoas tools2026-08-05

  General SAST tool recommended to run alongside SecureAI-Scan, not instead of it

• Beetle
  repoas tools2026-07-31

  Integrated as 'Semgrep Intelligence' for static analysis detection

• Semgrep Rules (0xdea)
  repoas tools2026-07-31

  static analysis engine used to run the custom rule set for vulnerability research; tested with Semgrep CLI 1.169.0

• How we use /goal to find bugs in Patch the Planet
  writeupas tools2026-07-28

  used to turn past CVEs into rules that fire on vulnerable versions and stay silent on patched ones, to detect variant bugs (flagged 11 variant hits across multiple projects)

• AI code security harnesses compared
  articleas tools2026-07-24

  Deterministic rule-based static analysis tool used as input/prefilter to guide LLM search space in several hybrid harnesses

• AI Security Briefing
  writeupas tools2026-07-18It is written here as Semgrep (via Open Interpreter's safe_mode).

  Optional static analysis safety layer in Open Interpreter; not exercised in this survey

• Argo
  repoas tools2026-07-18

  rule-based static analyzer, contrasted with Argo's LLM-native approach

• LocxZ/SecureSDLC-Lab
  repoas tools2026-07-14

  SAST (static application security testing)

• Benchmarking Endor Labs AI SAST: 2.6x more real vulnerabilities found than frontier models | Blog | Endor Labs
  articleas classification.technologies2026-07-06
• RAPTOR
  repoas tools2026-06-28

  Static analysis tool used for scanning; RAPTOR ships ~150 custom taint-tracking and pattern rules plus registry packs (p/security-audit, p/owasp-top-ten, p/secrets, p/command-injection, p/jwt, p/xss)

• Introducing GuardDog 3.0: new YARA rules engine, risk scoring, and sandboxing
  articleas tools2026-06-26

  Previously used by GuardDog to run source-code heuristics (SAST); moved away from due to high memory use, slow scanning on many-file packages (spawns a process per scan), and overly narrow/overfit rules.

• FoxGuard
  repoas classification.technologies2026-05-16
• One year of Opengrep: What we built and what’s next
  articleas classification.technologies2026-05-12
• Pantheon-Security/medusa
  repoas tools2026-05-10

  Pattern-based security analysis tool, used as external subprocess scanner and cited as inspiration

• Quacc++
  writeupas tools2026-05-07

  Open-source static analysis tool (by Semgrep Inc., formerly r2c) that performs semantic/structural code matching using custom rules, metavariables, and taint analysis to find security vulnerabilities such as SQL injection, hardcoded credentials, and disabled certificate validation

• DragonJAR/Android-Pentesting-Skill
  repoas tools2026-05-07

  Static analysis using MASTG-aligned rules (70+ rules)

• n8n Cybersecurity Workflows
  repoas tools2026-05-06

  Static application security testing (SAST) on pull requests

• CVE-2026-41940: cPanel & WHM Pre-Auth RCE — Two Write Paths, One Filter
  writeupas tools2026-05-01

  Used by researchers to scan the cPanel/WHM Perl codebase (5,484 modules, ~46 MB) for structural siblings of the same vulnerability pattern, using eight custom rules: cpanel-conditional-encoder-gate, cpanel-flushconfig-equals, cpanel-load-config-equals, cpanel-truthy-auth-gate, cpanel-api-hardcoded-r

• DeepZero
  repoas toolsIt is written here as Semgrep (semgrep_scanner processor).

  Semgrep batch scanner used as a BulkMapProcessor, with custom rules in pipelines/loldrivers/rules/

• 973 MCP Packages, 71% Single-Maintainer: A Practitioner
  articleas toolsIt is written here as Semgrep (SAST).

  SAST

In every workspace you can read 28