March 2025 Summaries

An expert-designed survey aims to assess the maturity of Application Security (AppSec) programs by offering participants tailored guidance based on their responses. The survey provides a customized report with recommendations, including cost-effective improvements suitable for various maturity levels, while ensuring anonymity by aggregating and anonymizing participant data. Upon submission, participants are added to a newsletter to receive early access to community results and insights from the survey. The initiative targets AppSec program managers, security leads, and engineers in search of practical and affordable strategies to enhance their security posture. Once sufficient data is collected, in-depth articles will be published, highlighting aggregated trends and strategies to benefit the broader industry.

The 2025 Cloud & Cyber Security Expo, held at ExCeL London, gathered numerous security practitioners and industry leaders to discuss key themes in cybersecurity, including AI-driven security, zero trust, DevSecOps integration, and cloud security challenges. The event emphasized the importance of embedding security into developer workflows, automating processes to enhance scalability, and fostering a strong security culture. Semgrep played a significant role as a platinum sponsor, showcasing its tools aimed at enhancing developer-centric security and participating in panel discussions on integrating security into DevOps to tackle emerging threats. The discussions highlighted the need for AI and automation in addressing the skills gap in cybersecurity and emphasized a shift towards proactive security measures that ensure seamless integration into existing workflows. As the expo concluded, the overarching message was that effective cybersecurity practices should enable rather than hinder development, pointing to a future where automation and human expertise find a balanced collaboration.

The popular GitHub Action, tj-actions/changed-files, has been compromised with a payload designed to reveal secrets, affecting numerous CI pipelines. This incident is not isolated, as a prior vulnerability (CVE-2023-51664) had already been reported. To mitigate the risk, users are advised to search their codebase for the compromised action and replace it with safer alternatives or inline logic. GitHub provides a feature to allow-list actions to prevent execution, even if present in the code. Users are also encouraged to audit past workflow runs for signs of compromise, such as suspicious outbound network requests, especially in public CI runner logs. The compromised action's tags have been reverted, and a new version has been released. Further research indicated additional compromises in reviewdog actions, necessitating similar precautions. Users are recommended to rotate any potentially exposed secrets and ensure they use immutable commits to avoid future vulnerabilities, while Semgrep has provided rules to detect usage of both tj-actions and reviewdog actions.

OCaml 5's introduction of multicore support necessitated significant changes, including a major overhaul of the garbage collector and memory allocator to maintain performance across single-threaded and multi-threaded programs. Despite successful benchmarks for most programs, the transition to OCaml 5 led to memory consumption issues in Semgrep, prompting investigations into garbage collection behavior and the introduction of dynamic tuning strategies. Initial assumptions pointed to the absence of garbage collector compaction as the cause, but further analysis revealed that different garbage collector behaviors were responsible. Through experiments, adjusting the space_overhead parameter dynamically based on heap size improved memory management and performance, allowing the successful deployment of OCaml 5 in production. The resultant dynamic garbage collector tuning utility, designed to mimic OCaml 4 performance, was open-sourced for broader application within the OCaml community, with future improvements planned to enhance its adaptability and user customizability.

In the fast-paced Software as a Service (SaaS) industry, where rapid development and frequent code releases are the norm, traditional security measures often struggle to keep up, leading to increased risks and potential vulnerabilities. The tension between maintaining speed and ensuring security has historically forced developers to choose between the two. However, modern solutions like Semgrep offer a way to integrate security into the development process without compromising speed. By utilizing AI-powered and context-aware scanning, Semgrep reduces false positives and provides high-precision, real-time security checks that fit seamlessly into existing CI/CD pipelines. This developer-first approach to security enables teams to address vulnerabilities as they arise, fostering a security model that accelerates, rather than hinders, development. As SaaS companies strive to balance velocity with protection, tools like Semgrep are pivotal in embedding security into the workflow, thus empowering developers to maintain both speed and safety in their code.

Semgrep's Supply Chain Policies offer a flexible and developer-friendly approach to enhancing software supply chain security without compromising productivity. By providing fine-grained control over security settings, these policies allow Application Security (AppSec) teams to integrate robust security measures seamlessly into CI/CD workflows. Unlike traditional one-size-fits-all security tools that burden developers with unnecessary alerts, Semgrep's policies enable organizations to tailor security controls based on repository-level needs, vulnerability reachability, severity, and exploit prediction. This customization reduces noise, prioritizes critical threats, and streamlines developer workflows by focusing on actionable alerts. Additionally, Semgrep's system is adaptable to enterprise needs, allowing gradual policy rollouts and differentiation between open-source and private code repositories, ensuring security measures align with business requirements while maintaining developer efficiency.

Significant improvements were made to the Semgrep engine to enhance security coverage for JavaScript and TypeScript server-side frameworks, focusing on the Node.js runtime and widely-used frameworks such as Express, Koa, Hapi, and NestJS. The updates included enhancements like dependency injection tracking, improved module resolution, and better handling of callbacks to reflect real-world development patterns, which were validated against security benchmarking repositories like OWASP JuiceShop and BrokenCrystals. The focus on server-side analysis is due to the higher risk of vulnerabilities like SQL injection and Remote Code Execution, which can have severe consequences by compromising entire systems. To ensure effective vulnerability detection, the Semgrep engine was enriched with language-specific features, enabling it to accurately trace data flows and identify security risks in production-level codebases by analyzing over 150 real-world open-source projects. The development process involved creating security rules for common vulnerabilities using static analysis, which was tested and fine-tuned through continuous scanning of open-source projects, leading to the discovery of several vulnerabilities that were reported to maintainers.

The integration of Semgrep and Wiz offers a unified approach to application and cloud security by enhancing the ability of security teams to prioritize vulnerabilities based on real-world risk exposure. This partnership bridges the gap between code and cloud environments by correlating Static Application Security Testing (SAST) findings with cloud infrastructure and runtime data within Wiz’s Security Graph. By combining Semgrep's code security capabilities with Wiz's cloud security insights, teams can identify critical vulnerabilities, understand their real-world implications, and reduce alert fatigue by focusing on the highest-risk issues. This collaboration aims to improve the efficiency of security teams and developers by providing clear guidance for remediation while adapting to the evolving challenges of securing modern, cloud-based applications.