Verification · Static analysis · Static application security testing

Custom rule packs

Rules for the framework and helpers your code uses, with tests for each rule.

How to build it

Write a rule for each wrapper that bypasses a safe path, such as a raw query builder or an unchecked HTTP client.
Add a positive and a negative test file per rule and run the rule tests in CI.
Keep each rule beside the code it covers and review rule changes like production code.

Signals in a repository

A rules directory with one YAML file per framework helper.
Test files paired with each rule, with annotations that mark expected findings.
A CI step that runs the rule test command, such as semgrep --test.

In practice

15 repositories run a tool for this check in the scanned set.

semgrep · 15 repos

Examples

vitejs/vite · semgrep

semgrep scan --quiet --sarif --config auto --exclude playground --exclude __tests__ --exclude-rule javascript.lang.security.audit.detect-non-literal-regexp.dete

mvanhorn/last30days-skill · semgrep
```
semgrep scan --config=p/default
```
appwrite/appwrite · semgrep
```
semgrep test .semgrep
```

prisma/prisma · semgrep

semgrep scan --severity ERROR --error --sarif --config auto --exclude-rule javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection

diegosouzapw/OmniRoute · semgrep

semgrep scan --config p/owasp-top-ten --config p/secrets --sarif --output semgrep.sarif --metrics off