Verification · Static analysis · Static application security testing

Pattern rules

Syntax-aware patterns for dangerous calls and configurations (shell=True, yaml.load, disabled TLS verification).

How to build it

Enable a pattern scanner with a community rule pack for the languages in the repository.
Record the findings at adoption as a baseline so only new findings block a change.
Disable a rule that flags an accepted pattern only in the config, with the reason beside it.

Signals in a repository

A .semgrep.yml file or a rules directory with YAML pattern rules.
A bandit run in CI or pre-commit with a config file listing skipped tests.
A workflow step that runs semgrep or opengrep and uploads SARIF.

In practice

19 repositories run a tool for this check in the scanned set.

semgrep · 15 repos
bandit · 6 repos

Examples

vitejs/vite · semgrep

semgrep scan --quiet --sarif --config auto --exclude playground --exclude __tests__ --exclude-rule javascript.lang.security.audit.detect-non-literal-regexp.dete

mvanhorn/last30days-skill · semgrep
```
semgrep scan --config=p/default
```
appwrite/appwrite · semgrep
```
semgrep test .semgrep
```

prisma/prisma · semgrep

semgrep scan --severity ERROR --error --sarif --config auto --exclude-rule javascript.express.security.express-wkhtml-injection.express-wkhtmltoimage-injection

apache/airflow · bandit
```
bandit
```