April 2021 Summaries

Semgrep has introduced a new ruleset specifically designed for detecting secrets in source code, including passwords, API keys, and other sensitive information like webhook URLs and Slack tokens. This ruleset, which comprises 38 detection rules, can be applied across various file formats, thanks to Semgrep's support for JSON, alpha YAML, and an experimental generic matching mode. Users can customize these rules to fit specific organizational needs, and the tool offers options for composition and filtering to minimize false positives. To manage the potentially high volume of alerts from secret detection, Semgrep recommends using an audit mode that logs findings without blocking builds, providing visibility through the Semgrep App’s dashboard and notifications. The platform also encourages iterative refinement of rules to focus on relevant findings and highlights the availability of other secret scanning tools like truffleHog, git-secrets, and shhgit as complementary resources.

Semgrep, a tool designed to identify security bugs and anti-patterns in code, has expanded its capabilities to include the scanning of Semgrep rules themselves, along with YAML configurations such as Kubernetes and CircleCI workflows. The tool's rules are written in YAML, a format that, while simple, can be prone to errors if not carefully managed. To address this, Semgrep has developed a YAML parser capable of providing location information, allowing for precise error reporting. The introduction of special syntax, like the "__semgrep_ellipsis__" operator, enhances YAML compatibility and allows for more efficient parsing. This update not only facilitates the writing of Semgrep rules for Semgrep rules but also enables users to apply existing JSON rules to YAML files, broadening the scope of security checks. Despite the current limitations, such as the lack of support for aliases and anchors, this development promises to enhance the functionality and accuracy of Semgrep in securing YAML configurations, with ongoing improvements anticipated as user feedback is incorporated.