I wrote four Semgrep rules and never ran them. Two were broken.

I have a line I use a lot: a finding is a snapshot, a rule is a ratchet. Find a bug once and you've closed one instance. Write the rule and you've closed the class, including in code nobody will ever