February 2023 Summaries

Semgrep, an open-source code security tool, has evolved with significant contributions from its community, offering over 2500 community rules for security auditing. To enhance security programs, Semgrep introduced Semgrep Code, featuring proprietary high-confidence Pro rules developed by r2c’s Security Research team. These rules, designed for developers, aim to provide accurate security findings by leveraging advanced Semgrep features like taint tracking analysis, enabling precise detection of vulnerabilities across various languages and frameworks. High-confidence rules focus on reducing false positives, making them valuable for CI/CD pipelines by offering actionable insights, whereas low-confidence rules cast a wider net, beneficial for comprehensive security auditing. As an example, Pro rules improve upon existing community rules by incorporating user input considerations and advanced pattern matching for vulnerabilities such as SQL injection. The Pro rule set includes coverage for hard-coded secrets, XXE, deserialization vulnerabilities, and injection vulnerabilities across multiple programming languages and frameworks, supported by regular updates and improvements.

Semgrep Code is a newly launched security platform designed to enhance code analysis by addressing the limitations of traditional Static Application Security Testing (SAST) tools. Building on the existing Semgrep open-source tool, Semgrep Code introduces the Pro Engine and Pro rules to deliver more accurate and comprehensive vulnerability detection through advanced interfile and inter-procedural analysis. The platform aims to integrate seamlessly into developer workflows, offering quick and actionable findings that help remediate vulnerabilities in real-time. It supports a wide array of programming languages, including Java, JavaScript, and Apex, and provides high-confidence, high-coverage rules crafted by the Semgrep Security Research team. Semgrep Code also facilitates easy monitoring and triaging of vulnerabilities through its cloud platform, aiming to empower organizations to maintain robust security programs efficiently.