Awesome Reviewers

Verification · Static analysis

Static application security testing

Finds injection, unsafe APIs, weak crypto and tainted data reaching a sink without running the code.

Sub-techniques

  • Pattern rules V1007.001

    Syntax-aware patterns for dangerous calls and configurations (shell=True, yaml.load, disabled TLS verification).

  • Taint tracking V1007.002

    Follow untrusted input from sources to sinks across functions and files.

  • Language security linters V1007.003

    Per-language security rule sets maintained by each ecosystem.

  • Custom rule packs V1007.004

    Rules for the framework and helpers your code uses, with tests for each rule.

How to build it

  1. Run a pattern scanner with a community rule pack and record the baseline.
  2. Write custom rules for your own wrappers (your query builder, your HTTP client), each with a positive and negative test file.
  3. Scan only changed files on PRs (diff-aware mode) and the whole repository on a schedule.

Signals in a repository

  • A codeql-analysis workflow, .semgrep.yml or a rules/ directory with YAML rules.
  • bandit, gosec or security-code-scan in CI or pre-commit.
  • SARIF uploads (github/codeql-action/upload-sarif) in workflows.