CheatPress

Semgrep Static code scanning

Version 1.181 · source

Semgrep, Postcard, light preview Light · Postcard 102 × 152 mm · PDF Semgrep, Postcard, dark preview Dark · Postcard 102 × 152 mm · PDF Semgrep, Postcard, ink saver preview Ink saver · Postcard 102 × 152 mm · PDF
Semgrep, A5, light preview Light · A5 148 × 210 mm · PDF Semgrep, A5, dark preview Dark · A5 148 × 210 mm · PDF Semgrep, A5, ink saver preview Ink saver · A5 148 × 210 mm · PDF
Semgrep, A4, light preview Light · A4 210 × 297 mm · PDF Semgrep, A4, dark preview Dark · A4 210 × 297 mm · PDF Semgrep, A4, ink saver preview Ink saver · A4 210 × 297 mm · PDF
Semgrep, A4 landscape, light preview Light · A4 landscape 297 × 210 mm · PDF Semgrep, A4 landscape, dark preview Dark · A4 landscape 297 × 210 mm · PDF Semgrep, A4 landscape, ink saver preview Ink saver · A4 landscape 297 × 210 mm · PDF
Semgrep, A3, light preview Light · A3 297 × 420 mm · PDF Semgrep, A3, dark preview Dark · A3 297 × 420 mm · PDF Semgrep, A3, ink saver preview Ink saver · A3 297 × 420 mm · PDF
Semgrep, A3 landscape, light preview Light · A3 landscape 420 × 297 mm · PDF Semgrep, A3 landscape, dark preview Dark · A3 landscape 420 × 297 mm · PDF Semgrep, A3 landscape, ink saver preview Ink saver · A3 landscape 420 × 297 mm · PDF
Semgrep, Letter, light preview Light · Letter 8.5 × 11 in · PDF Semgrep, Letter, dark preview Dark · Letter 8.5 × 11 in · PDF Semgrep, Letter, ink saver preview Ink saver · Letter 8.5 × 11 in · PDF
Semgrep, Tabloid, light preview Light · Tabloid 11 × 17 in · PDF Semgrep, Tabloid, dark preview Dark · Tabloid 11 × 17 in · PDF Semgrep, Tabloid, ink saver preview Ink saver · Tabloid 11 × 17 in · PDF

Start here

semgrep scan --config auto
Scan with recommended rules
semgrep scan --config <rules>
Use a rule file or ruleset
semgrep -e '<pattern>' --lang <lang>
Ad-hoc pattern search
semgrep scan --severity ERROR
Only serious findings
semgrep scan --json -o <file>
Machine-readable output
semgrep scan --error
Exit 1 on findings
semgrep ci
Run in CI on the diff
# nosemgrep
Ignore a line

Concepts

  1. Rules YAML / registry
  2. Targets files, ignores applied
  3. Findings severity, location
  4. Report exit code, files

Scanning

semgrep scan
Scan the current directory
Needs a --config, or a local semgrep config file is not picked up automatically.
semgrep scan --config auto
Registry rules chosen for your code
Requires login-free network access; sends project metadata.
semgrep scan --config <file|dir>
Run local rule files
semgrep scan --config p/<ruleset>
Run a registry ruleset
For example p/security-audit or p/python.
semgrep scan <path>
Scan only a file or folder
semgrep scan --severity <level>
Filter by INFO, WARNING, ERROR
Repeat the flag for several levels.
semgrep scan --exclude-rule <id>
Skip a rule
semgrep scan --include <glob>
Only paths matching glob
semgrep scan --exclude <glob>
Skip paths matching glob
semgrep scan -j <n>
Number of parallel jobs
semgrep scan --timeout <sec>
Per-rule per-file time limit
semgrep scan --max-target-bytes <n>
Raise the file size limit
Files over 1 MB are skipped by default.
semgrep scan --metrics off
Disable metrics

Ad-hoc patterns

semgrep -e '<pattern>' -l <lang> <path>
Search with a pattern
semgrep -e 'eval(...)' -l python .
Find any eval call
... matches any arguments.
semgrep -e '$X == $X' -l <lang> .
Metavariable, same value twice
$X binds to any expression; repeating it requires equality.
semgrep -e '<pat>' --replacement '<new>' -l <lang> --autofix
Rewrite matches
Add --dryrun to preview the change.
Pattern syntax
Syntax Matches
... any arguments or statements
$X any expression (metavariable)
<... p ...> p nested anywhere inside

Output

semgrep scan --json
JSON to stdout
semgrep scan --sarif -o <file>
SARIF report to a file
For code-scanning uploads such as GitHub.
semgrep scan --json-output <file>
JSON file, text on screen
semgrep scan --junit-xml
JUnit XML output
semgrep scan --gitlab-sast
GitLab SAST format
semgrep scan --dataflow-traces
Show taint paths in text
semgrep scan -q
Quiet: findings only
semgrep scan -v
Verbose, show skipped files

CI & baseline

semgrep ci
Scan in CI, fail on blocking findings
Works with a Semgrep account; reports to the platform.
semgrep ci --baseline-commit <ref>
Only findings new since ref
semgrep scan --baseline-commit <ref>
Same for plain scan
Compares against the given commit; needs a git repo.
semgrep scan --error
Exit 1 when findings exist
semgrep ci --subdir <dir>
Scan only a subdirectory
semgrep login
Authenticate with semgrep.dev
semgrep ci --code
Run only code (SAST) scans
semgrep scan --strict
Fail on invalid target code

Ignoring

# nosemgrep
Ignore this line or the next
Put it as a comment on the matching line or the line above.
# nosemgrep: <rule-id>
Ignore one rule only
Use the full rule id with namespace; separate several with commas.
.semgrepignore
Paths to skip, gitignore syntax
Replaces the default ignore list, which skips tests/, vendor/, node_modules/ and more.
:include .gitignore
Reuse gitignore in .semgrepignore
semgrep scan --no-git-ignore
Also scan gitignored files
semgrep scan --disable-nosem
Report nosemgrep lines anyway

Rules

semgrep scan --validate --config <file>
Check rule files are valid
semgrep scan --test <dir>
Run rule tests
Test files use # ruleid: and # ok: comments above the line.
semgrep scan --pro
Pro engine, cross-file analysis
Needs login and the Pro engine (install-semgrep-pro).
semgrep scan --oss-only
Never use Pro features
semgrep scan --secrets
Secrets scanning
Account required.
Exit codes
Code Meaning
0 ok, or findings without --error
1 findings with --error
2 fatal error
4 invalid pattern in rule
7 invalid rule or missing config

Recipes

Fail CI on serious findings
semgrep scan --config auto \  --severity ERROR --error
Only new findings in a pull request
semgrep scan --config p/ci \  --baseline-commit origin/main --error
Quick custom rule check
semgrep -e 'requests.get(..., verify=False)' \  -l python src/
Report for code scanning
semgrep scan --config auto \  --sarif -o semgrep.sarif