---
title: "Discussion on \"I wrote four Semgrep rules and never ran them. Two were broken.\" | Hashnode"
description: "Discussion on \"I wrote four Semgrep rules and never ran them. Two were broken.\". Four Semgrep rules, carefully reasoned and never executed. Running them found two defects — including one rule that fired on the remediated code."
url: "https://hashnode.com/posts/semgrep-rules-i-never-ran/6a8349300aa58983de2c4754"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [I wrote four Semgrep rules and never ran them. Two were broken.](https://paulappsec.hashnode.dev/semgrep-rules-i-never-ran?utm_source=hashnode&utm_medium=feed)

Four Semgrep rules, carefully reasoned and never executed. Running them found two defects — including one rule that fired on the remediated code.

Aug 17 · 7 min read · paulappsec.hashnode.dev  
Read the article

-   [#semgrep-security-devsecops-javascript-testing](https://hashnode.com/tag/semgrep-security-devsecops-javascript-testing)
-   [#semgrep](https://hashnode.com/tag/semgrep)
-   [#security](https://hashnode.com/tag/security)
-   [#devsecops](https://hashnode.com/tag/devsecops)
-   [#javascript](https://hashnode.com/tag/javascript)
-   [#testing](https://hashnode.com/tag/testing)

## Written by

[Paul MK](https://hashnode.com/@paulappsec)

@paulappsec · Nairobi

  
[View profile](https://hashnode.com/@paulappsec)

I write the vulnerable code, exploit it, then ship the patch — so your team can see all three. Software engineer first, AppSec by consequence.

I write the vulnerable code, exploit it, then ship the patch — so your team can see all three. Software engineer first, AppSec by consequence.

## Responses

Markdown supported · ⌘↵ to post

No responses yet.