June 2022 Summaries

Vivek, an undergraduate student at Drexel University, shares his experience as a Software Engineer intern at the startup r2c, highlighting the differences between working at a startup and a big-tech company. During his 12-week internship, Vivek was involved in hands-on projects from day one, working primarily on extending APIs and developing a Semgrep Slack integration, which allowed him to directly contribute to customer-facing and cross-team projects. He appreciated the fast-paced, impactful environment at r2c, where engineering time was valued, and projects were evaluated based on customer needs and company goals. The experience taught him the importance of customer-driven development and the willingness to discard or rewrite code based on feedback. Vivek valued the opportunity to work closely with senior engineers and was impressed by the passionate, hard-working, and humble company culture, which made his internship a memorable experience despite his sadness at leaving the team.

PHP is now fully supported in Semgrep, reaching a parse rate of over 99.9%, thanks largely to contributions from Sjoerd Langkemper, who played a crucial role in integrating PHP support and enhancing C# capabilities. The Semgrep community has developed over 40 PHP rules in the Registry, including those targeting SQL injection in Laravel, and Federico Dotta has contributed additional rules focused on PHP security assessments, specifically SQL injection, Cross-Site Scripting, and authorization bypass. To utilize Semgrep for PHP code scanning, users can integrate it with GitHub or GitLab projects for automated checks on pull or merge requests and run the command line tool with Semgrep v0.99.0 or higher.

Organizations face unique security challenges, and Semgrep addresses these by offering custom rules tailored to specific security needs, helping to enforce internal functions and reduce false positives. These custom rules have proven effective in catching and preventing vulnerabilities, thus saving time and resources. Semgrep's Playground allows users to write, test, and refine custom rules efficiently, with recent enhancements enabling rule creation in under ten minutes. Users can fork existing rules from the Registry, collaborate with others, and share rules both privately and publicly. Once ready, rules can be added to a Rule Board to monitor their performance across codebases, with community support available via Slack for additional assistance.