I wrote four Semgrep rules and never ran them. Two were broken.

Four Semgrep rules, carefully reasoned and never executed. Running them found two defects — including one rule that fired on the remediated code.