April 2023 Summaries

Semgrep, formerly known as r2c, has raised $53 million in a Series C funding round led by Lightspeed Venture Partners, with participation from Felicis, Redpoint, and Sequoia, to further develop its open-source code scanning tool designed for security and software engineers. Unlike traditional black-box scanners, Semgrep offers transparency and flexibility by allowing engineers to view, edit, or create scanning rules, thereby enhancing their ability to identify and eliminate root causes of vulnerabilities. The company has introduced two commercial products—Semgrep Code and Semgrep Supply Chain—which utilize proprietary technology to significantly reduce false positives in vulnerability scanning and provide comprehensive analysis of both first-party and third-party code. Semgrep's innovative approach has garnered positive feedback from users, who appreciate its ease of use and effectiveness in finding bugs that other tools miss, and it is increasingly being adopted as a standard for static analysis by leading security consultancies and platforms like GitLab and Datadog. With a growing library of over 40,000 unique rules across 30+ programming languages, Semgrep is positioned as a creative platform for developers and security engineers to customize their security processes, and it is exploring the integration of large language models to further enhance its capabilities.

Semgrep Code, a specialist in Static Application Security Testing (SAST) solutions, faced significant challenges in developing interfile analysis to enhance their developer-focused security tools. The primary goal was to create a security solution that developers could easily understand and improve, leading to the development of the open-source tool, Semgrep, which allows for semantic code pattern searches. Initially, Semgrep was limited to single-file analysis, but recognizing the importance of interfile analysis for securing code, the company embarked on adding this capability. The process involved creating a focused benchmark using Java and SQL injection vulnerabilities and iterating with users to refine the tool. Despite technical difficulties and the need for extensive user engagement, Semgrep successfully launched interfile analysis for Java and JavaScript, significantly improving detection capabilities. The journey highlighted the importance of user feedback and the challenges of balancing technical development with user needs, ultimately resulting in a more robust security product that can identify vulnerabilities across multiple files and support various programming languages.

Semgrep, a popular code search tool used for security scanning, has integrated GPT-4 into its cloud service to improve the triaging of security findings, aiming to distinguish which alerts are relevant before notifying developers. This integration has shown promising results in internal projects, offering insightful triaging decisions and sometimes automatically fixing code, though not always perfectly. The tool addresses a common issue in the SAST industry of high false positive rates, which can be challenging for less experienced developers to manage. By leveraging GPT-4's understanding of programming languages, Semgrep can reduce confusion around false positives and provide helpful explanations. Additionally, the AI's ability to suggest code fixes is being tested, with the goal of achieving a high rate of directly committable changes, though challenges remain in prompting the AI correctly. The integration aims to enhance productivity by reducing the need for discussions around code fixes, similar to how auto-formatters work, and is available for private beta testing, where AI suggestions are still being refined.

Semgrep has introduced Semgrep Assistant, an AI-augmented tool that leverages GPT to enhance security in code by making triage suggestions and providing automatic code fixes within pull requests. This innovation aims to improve the fix rate by helping developers determine true positives and offering tailored code-change suggestions, thus reducing the time spent on security issues. The use of GPT allows Semgrep to go beyond typical parsing and dataflow engines, offering insights into context that might cause false positives, such as test code or code mitigated by configuration settings. Additionally, Semgrep is exploring the potential of GPT to write or update custom rules, which could simplify the process of creating YAML-based rules for pattern detection in code. The company invites interested parties to join a waitlist for their private beta, offering the opportunity to experiment with the tool and provide feedback.