Top all-time · #1188
Semgrep App Security Platform
Company blog · semgrep.dev/blog · on HN as ievanssecurityprogramming
Semgrep App Security Platform is the company blog at semgrep.dev, writing about security and programming. Since 2020, 59 different Hacker News readers have linked it 105 times, most often “Semgrep – Find bugs and enforce code standards”. No feed was found, so read it on the site itself.
Rarely recommended · 0 of 40 sampled comments recommend it?
Why HN links it
HN readers link semgrep.dev for its static analysis tool: rule registry, docs, playground and blog posts on supply-chain attacks. Comments mostly cite it as a reference or example rule.
Summarised by Claude from a sample of 40 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
An extensible developer-friendly application security platform that scans source code to surface true and actionable security issues with AI-assisted SAST, SCA, and Secrets Detection solutions.
Most-linked posts?
- Semgrep – Find bugs and enforce code standards10 people · 11 mentions · first linked 2021-02-17
- Semgrep: Semantic grep for code3 people · 3 mentions · first linked 2020-10-29
- Mini Shai-Hulud in Intercom Package Spreads to Packagist Using Composer Plugin2 people · 2 mentions · first linked 2026-05-01
- Crosscompiling OCaml to JavaScript and WASM to Make Semgrep Playground Fast2 people · 2 mentions · first linked 2023-06-06
- Show HN: Semgrep Assistant, a set of surgical AI tools for AppSec2 people · 2 mentions · first linked 2025-01-22
- Why It's Time to Rename Cybersecurity Awareness Month2 people · 2 mentions · first linked 2026-10-03
- /docs/getting-started/2 people · 2 mentions · first linked 2021-04-22
- /p/nginx2 people · 2 mentions · first linked 2023-07-04
- Nx compromised: malware uses Claude code CLI to explore the filesystem2 people · 2 mentions · first linked 2025-08-27
- You Can't Reverse Engineer Your Way Out of the AI Supply Chain Problem2 people · 2 mentions · first linked 2026-07-20
What Hacker News says?
You'll love taint checking then. https://en.wikipedia.org/wiki/Taint_checking https://semgrep.dev/docs/writing-rules/data-flow/taint-mode/...
Comment linking /docs/writing-rules/data-flow/taint-mode/overview
on “Show HN: Gemini Pro 3 imagines the HN front page 10 years from now”Submitted Nx compromised: malware uses Claude code CLI to explore the filesystem as a story · 493 points
HN discussionHi. Co-author of the post here. Good callout. Evidence so far points to `nx --version` itself being safe because this was in a post-install script but we changed the rec in our post. We took the versions in the Github security advisory and compiled it into a Semgrep rule which is MIT-licensed: https://semgrep.dev/c/r/oqUk5lJ/semgrep.ssc-mal-resp-2025-08... . Semgrep rules can be overkill for these use cases but it c…
Comment linking /c/r/oqUk5lJ/semgrep.ssc-mal-resp-2025-08-nx-build-compromised
on “Nx compromised: malware uses Claude code CLI to explore the filesystem”Submitted Semgrep: Semantic grep for code as a story · 415 points
HN discussionthis company is something else https://semgrep.dev/solutions/secure-vibe-coding/ if software development is turning into their demo: - does this code I've written have any vulnerabilities? - also what does the code do then I'm switching careers to subsistence farming and waiting for the collapse
Comment linking /solutions/secure-vibe-coding/
on “Nx compromised: malware uses Claude code CLI to explore the filesystem”Submitted Popular GitHub Action tj-actions/changed-files is compromised as a story · 282 points
HN discussion> They won’t install AI on your machine Actually they’ll just the AI you already have on your machine[0] In this attack, the malware would use Claude Code (with your credentials) to scan your own machine. Much easier than running the inference themselves! [0] https://semgrep.dev/blog/2025/security-alert-nx-compromised-...
Comment linking /blog/2025/security-alert-nx-compromised-to-steal-wallets-and-credentials/
on “Claude Sonnet will ship in Xcode”Submitted Finding vulnerabilities in Python web apps using Claude Code and OpenAI Codex as a story · 13 points
HN discussionThere is also a bug in the example rules single pages app. Go to https://semgrep.dev/p/jwt Go to the page 2/5 Click "Run Locally", so you can copy the code close the modal -> you're on page 1/5. Expectation would be to stay on page 2/5. It would also be very useful to be able to filter by language and topic.
Comment linking /p/jwt
on “Semgrep: Semantic grep for code”Submitted Lsp.js: Using WASM and JavaScript to Support OCaml on Windows as a story · 12 points
HN discussionIs there a more complete example of how to call semgrep from pre-commit (which gets called before every git commit) in order to prevent e.g. Python print calls (print(), print \\n(), etc.) from being checked in? https://semgrep.dev/docs/extensions/ describes how to do pre-commit. Nvm, here's semgrep's own .pre-commit-config.yml for semgrep itself: https://github.com/returntocorp/semgrep/blob/develop/.pre-co...
Comment linking /docs/extensions/
on “Semgrep: Semantic grep for code”Submitted Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library as a story · 11 points
HN discussionIt does seem potentially good for enforcing standards where the participants are willing. But you can work around it fairly easily. Like the example "python no-prints" rule: https://semgrep.dev/s/sabihb:no-prints Lots of workarounds it wouldn't find, like: import builtins builtins.print("whee")
Comment linking /s/sabihb:no-prints
on “Semgrep: Semantic grep for code”Submitted Securing CodeQL queries using Semgrep as a story · 11 points
HN discussionTypo in the "Trying Semgrep" screenshot ("ruleste"): https://semgrep.dev/static/media/Step1.df848497.png
Comment linking /static/media/Step1.df848497.png
on “Semgrep: Semantic grep for code”Submitted Show HN: Semgrep Assistant, a set of surgical AI tools for AppSec as a story · 8 points
HN discussionHey, I work on Semgrep. As a real world example, I just noticed today that Hashicorp uses a whole bunch of Semgrep rules on terraform-provider-aws[0]. I'd recommend reading the `message` keys to know what they intend to match, and then the `patterns` lists below to see how that's accomplished. Alternatively, we curate 1000+ community rules that you can look through as well.[1] [0]: https://github.com/hashicorp/terra…
Comment linking /r
on “Semgrep: Semantic grep for code”Submitted Semgrep – lightweight, offline, open-source, static analysis tool as a story · 8 points
HN discussionSemgrep started off as a “syntactic grep” but has increasingly become more semantic. So if you want to find all calls to foo that have 1 as the first argument, you just search for foo(1) and even things like x = 1; foo(x); will match. Here’s an elaborate example: https://semgrep.dev/s/ievans:c-dataflow
Comment linking /s/ievans:c-dataflow
on “Semgrep: Semantic grep for code”Submitted Security Engineers – a MCP audit checklist for you as a story · 7 points
HN discussionThe cli is here: https://semgrep.dev/docs/getting-started/ You can write stuff like # Check for Python == where the left and right hand sides are the same (often a bug) $ semgrep -e '$X == $X' --lang=py path/to/src
Comment linking /docs/getting-started/
on “Semgrep: Semantic grep for code”Submitted Upgrading Semgrep from OCaml 4 to OCaml 5 as a story · 7 points
HN discussionFyi, there is already a widely used tool along with a company called semgrep, which stems from semantic grep: https://semgrep.dev/ .
Comment linking /
on “Show HN: Semantic Grep – A Word2Vec-powered search tool”Submitted You Can't Reverse Engineer Your Way Out of the AI Supply Chain Problem as a story · 4 points
HN discussionThe existing pattern suggested above, "match ...:", will not match 'match = ...'. Presumably the reason the parent comment suggested semgrep, not just a grep, is because they're aware that naive substring matching would be wrong. You could use the playground to check your understanding before implying someone is an idiot. https://semgrep.dev/playground/new
Comment linking /playground/new
on “Crimes with Python's Pattern Matching (2022)”Submitted Making zero false positive SAST a reality as a story · 4 points
HN discussionSee also: - trufflehog: https://github.com/trufflesecurity/trufflehog - detect-secrets: https://github.com/Yelp/detect-secrets - semgrep secrets: https://semgrep.dev/products/semgrep-secrets -- (Paid, but may be included in existing licenses in some cases
Comment linking /products/semgrep-secrets
on “Entropy, a CLI that scans files to find high entropy lines (might be secrets)”Submitted The tech behind Semgrep Assistant's triage and remediation guidance as a story · 4 points
HN discussionA more interesting comparison than with Coccinelle is with semgrep ( https://semgrep.dev/ ) since it also supports semantic/structural pattern matching over a number of languages, but also adds in a bunch of Boolean logic into the mix, as well as some more advanced semantic features like constant propagation. Curious whether the teams behind these tools are aware of each other? I suppose it's unlikely that they're n…
Comment linking /
on “Comby - Structural code search and replace for every language”Submitted Making Semgrep rip: How Ripgrep inspired us to shave hours off (some) scans as a story · 3 points
HN discussion
