May 2024 Summaries

Semgrep has launched a public beta of its managed scanning service, designed to streamline the process of integrating code scanning into CI/CD workflows without the need for extensive configuration. This new feature allows security engineers to implement security scanning across numerous repositories with minimal effort by utilizing Semgrep’s infrastructure rather than their own. The managed scanning service connects to GitHub repositories through an application, making it possible to perform both full and diff-aware scans automatically on a scheduled basis and with every pull request. This eliminates the need for developers to allocate CI resources or coordinate with other teams, as the scans are run externally and findings are delivered directly through the Semgrep AppSec Platform, with options for findings to appear in pull requests. By reducing the maintenance overhead and the need for intricate setup, Semgrep managed scanning aims to empower developers and security teams to focus more on application security and less on infrastructure management.

Semgrep is enhancing its application security platform to make software more secure and easier for developers to manage. Their recent updates include managed scanning that allows seamless onboarding of up to ten thousand repositories with minimal configuration, enabling organizations to deploy security solutions quickly without overwhelming developers with false positives. Additionally, they have introduced project-level role-based access controls for enhanced security oversight and a revamped user interface for the Semgrep Supply Chain tool, which streamlines orchestration and provides improved vulnerability management capabilities. These updates are accompanied by performance improvements for scanning large monorepos, unification of policies across different Semgrep products, and new features like custom rules for secrets and enhanced code search capabilities. These developments aim to help organizations scale their security efforts efficiently, allowing them to remediate vulnerabilities quickly while maintaining a focus on usability and accuracy.

Transitive reachability analysis, while theoretically valuable for assessing vulnerabilities in layered dependencies, is fraught with challenges such as low actionability and a high rate of false positives, primarily due to the limitations of static analysis and complex dependency layers. Vendors like Semgrep, which focus on direct dependency analysis and prioritize accuracy by using abstract syntax trees, offer more actionable insights, reducing false positives and enabling developers to address vulnerabilities more effectively. Semgrep's approach, which includes features like license compliance and dependency search, aligns with user preferences for tools that provide immediate, tangible security improvements rather than broad but less actionable data. Consequently, transitive reachability is not a priority for Semgrep, which aims to focus on impactful security solutions that empower developers to remediate issues efficiently, though it remains hopeful about future advancements in managing transitive vulnerabilities.

Semgrep has launched a public beta for its new Code Search feature, designed for users with a paid license for Semgrep Code, which significantly accelerates the process of writing and deploying rules for identifying vulnerabilities. By enabling users to search across all their organization's repositories in seconds, Code Search reduces the feedback loop for rule evaluation from days to seconds, enhancing the confidence in rule deployment with a low false positive rate. This capability is particularly beneficial for security teams that need to scale their efforts efficiently, as evidenced by a customer who used Code Search to generalize a bug bounty submission and identify additional vulnerabilities, saving significant future costs. The feature is powered by AWS Lambda, allowing parallel scanning of multiple repositories, and is optimized to avoid unnecessary processing, making it both fast and effective. The developers invite feedback through an integrated UI button, encouraging users to share their experiences and suggestions for improvements.

Semgrep, a static analysis security testing (SAST) tool, has faced challenges in providing native support for Windows, primarily due to difficulties with compiling OCaml on Windows and the limitations of the Windows Subsystem for Linux (WSL). To address this, Semgrep has leveraged a previous hack project that transpiled OCaml to JavaScript, allowing the tool to run on Windows using the Node JavaScript engine. This approach required mapping Unix-specific system calls to Node's OS-agnostic primitives and addressing various Windows-specific issues, such as handling file line endings and adapting file system paths. Additionally, compiling parsers to WebAssembly (Wasm) was initially slow due to a specific LLVM optimization pass, which was eventually mitigated by contributing a patch to disable unnecessary optimizations. The result is a JavaScript-based Semgrep Language Server that supports Windows, enabling developers to receive security feedback during the coding process across different environments.

Semgrep Academy, founded by Tanya Janca, is an online learning platform offering free, on-demand courses in information security, including application security, secure coding, API security, static analysis, functional programming, and the use of Semgrep products. Aimed at removing financial barriers to education, the academy seeks to provide accessible learning opportunities for anyone interested in entering or advancing within the information security field, regardless of their background or experience level. The platform includes hands-on exercises, quizzes, videos, and PDF downloads, and offers certificates of completion for users to showcase their achievements. Janca emphasizes the importance of sharing knowledge within the community to strengthen collective defense capabilities and invites individuals at all stages of their careers to engage with the academy's resources to enhance their skills and capabilities in this rapidly growing industry.