Semgrep

Semgrep 是代码安全扫描平台，把静态分析（SAST）、依赖漏洞（SCA）与密钥泄露三类检查并到一个流程里。核心是它那套按语法树匹配的规则语言，写起来接近代码片段本身，团队可以自己写规则查内部约定，不必等厂商更新库。扫出来的问题带数据流路径，误报可以先挂起，修复建议能直接生成补丁。开源引擎在 GitHub 上，CLI 接 CI 只要一条命令，云版管跨仓库的策略与报表。 ⭐ GitHub: semgrep/semgrep — 17k stars 🔗 文档: https://semgrep.dev/docs

Semgrep is a code security platform that folds static analysis (SAST), dependency vulnerabilities (SCA) and secret detection into one pass. The core is a rule language that matches on the syntax tree and reads close to the code snippet itself, so teams write their own rules for internal conventions instead of waiting on a vendor library. Findings carry dataflow paths, false positives can be provisionally ignored, and suggested fixes can be turned into a patch. The engine is open source on GitHub, the CLI hooks into CI with one command, and the cloud tier manages cross-repository policy and reporting. ⭐ GitHub: semgrep/semgrep — 17k stars 🔗 Docs: https://semgrep.dev/docs