semgrep

Scan with rules

$ semgrep --config auto

$ semgrep --config auto [src/]

$ semgrep --config p/[security-audit]

$ semgrep --config [rules.yaml] [src/]

$ semgrep --json --config auto

$ semgrep --config auto --lang [python]

semgrep [options] [targets...]

semgrep is a fast, static analysis tool for finding bugs, detecting security issues, and enforcing code standards. It uses pattern-matching with a syntax similar to the target language.
The tool supports 30+ languages and has community rules for common security issues and code quality checks.

--config config

Rules configuration.

Target language.

JSON output.

SARIF output.

Apply automatic fixes.

Exclude paths.

Include paths.

Output to file.

Minimum severity.

Verbose output.

Rule quality varies. False positives require tuning. Custom rules need learning. Large codebases may be slow.

semgrep was developed by r2c (now Semgrep Inc.) and released around 2019. It built on academic research to create a practical, language-aware grep for code analysis.

grep(1), ast-grep(1), eslint(1), pylint(1)