October 2020 Summaries

r2c has developed Semgrep, an open-source code scanning tool designed to enhance software security by allowing developers to create custom security rules in minutes, offering an alternative to traditional compliance tools and simple linters. Unlike conventional commercial security tools, Semgrep aims to build guardrails for developers, similar to the approaches used by tech giants like Google, Facebook, and Amazon. With the backing of Redpoint Ventures and Sequoia Capital, r2c raised $13 million to further develop this tool, which has seen rapid adoption and growth, including support for multiple programming languages and integration with platforms like GitHub and GitLab. Semgrep's syntax-aware search capabilities facilitate the enforcement of secure coding practices, thereby increasing developer productivity and reducing security risks. Additionally, r2c offers Semgrep Community, a free service for managing Semgrep CI, and Semgrep Teams, a paid enterprise service, both aimed at providing modern AppSec program infrastructure. The Semgrep Registry, which contains over 900 rules contributed by r2c and the community, further supports developers in maintaining secure codebases.

The blog post advocates for empowering developers to handle security issues themselves, thereby allowing the security team to focus on broader security strategies. The author shares a case study where they and another developer identified and resolved a data leakage issue in their logs without involving the AppSec team, using Semgrep to prevent recurrence. By using SQLAlchemy's logging features, they discovered sensitive tokens were being logged, which prompted them to implement an ObfuscatedString type to prevent such occurrences in the future. To ensure this solution's longevity, they integrated Semgrep into their CI pipeline to enforce coding standards that prevent similar security issues, demonstrating how static analysis can be effectively used to uphold codebase security and avoid repetitive mistakes.

Clint Gibler, now Head of Security Research at r2c, shares his journey and insights into application security (AppSec) in this piece, emphasizing the limitations of traditional static analysis tools and the industry's need for more proactive security measures. He recounts how his early experiences with static analysis during his PhD and work with NCC Group highlighted the time constraints and inefficiencies faced by security consultants, often leading them to rely on simpler tools like grep. Despite the promise of advanced static analysis, many organizations struggle with false positives, costly licensing, and the complexity of customizing these tools, which often results in underutilization. Gibler argues that a shift towards building secure-by-default libraries and tools—rather than solely focusing on bug detection—can prevent vulnerabilities more effectively. He explains his decision to join r2c, a company developing Semgrep, an open-source static analysis tool, drawn by its alignment with his vision for AppSec and its culture of technical excellence and agility. Gibler envisions a future where Semgrep helps enforce secure defaults, thereby allowing developers to focus on building software without the constant concern of security vulnerabilities.

The post outlines an effective methodology for writing custom Semgrep rules, a process that involves brainstorming the specific code patterns to identify, creating sample source files with example code snippets, and writing an initial Semgrep rule to match those patterns. The guide emphasizes the importance of testing and refining the rule on both single and multiple real code repositories to minimize false positives and negatives. Once satisfied with the rule's performance, it should be integrated into continuous integration (CI) systems to ensure ongoing code quality. The methodology encourages a data-driven approach, leveraging user feedback and metrics to continuously improve the rules, and highlights the importance of maintaining open communication with engineering teams to enhance rule efficacy and developer engagement.