--- title: "#semgrep articles | Hashnode" description: "Explore 25 articles tagged #semgrep on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/semgrep" --- Tag # #semgrep 25 posts · 1 followers [Varun Varde](https://hashnode.com/@varunvarde) · [Nov 3](https://hashnode.com/posts/how-to-build-a-devsecops-pipeline-in-one-day-using-open-source-tools/6ae9ab685f284b78f868c9cb) ### [How to Build a DevSecOps Pipeline in One Day Using Open-Source Tools](https://varunvarde.hashnode.dev/how-to-build-a-devsecops-pipeline-in-one-day-using-open-source-tools?utm_source=hashnode&utm_medium=feed) Learn how to build a practical DevSecOps pipeline in one day using open-source tools for code scanning, dependency security, container scanning, 22 min read · [varunvarde.hashnode.dev](https://varunvarde.hashnode.dev/how-to-build-a-devsecops-pipeline-in-one-day-using-open-source-tools?utm_source=hashnode&utm_medium=feed) [bo](https://hashnode.com/@cicada-369) · [Oct 28](https://hashnode.com/posts/paircoding-with-ai/6ae252477225699a1b7b5692) ### [What Pair Coding Actually Looks Like.](https://bokaung.hashnode.dev/paircoding-with-ai?utm_source=hashnode&utm_medium=feed) This is not a tutorial written after the fact. It is a record of a pair-coding session: I asked Claude Code to show me how to scan SkillTriage with Semgrep, and we worked through it together. The comm 10 min read · [bokaung.hashnode.dev](https://bokaung.hashnode.dev/paircoding-with-ai?utm_source=hashnode&utm_medium=feed) [AngusKit](https://hashnode.com/@anguskit) · [Oct 19](https://hashnode.com/posts/replace-semgrep-trivy-and-gitleaks-scripts-with-one-scan-gate/6ad613a2b6088d0e98730c6f) ### [Replace Semgrep, Trivy, and Gitleaks scripts with one scan gate](https://anguskit.hashnode.dev/replace-semgrep-trivy-and-gitleaks-scripts-with-one-scan-gate?utm_source=hashnode&utm_medium=feed) When CI runs three scanners with three logs, fold them into one job, one Finding model, and one gate—plus a Semgrep migration checklist. 7 min read · [anguskit.hashnode.dev](https://anguskit.hashnode.dev/replace-semgrep-trivy-and-gitleaks-scripts-with-one-scan-gate?utm_source=hashnode&utm_medium=feed) [Lemon and Ginger](https://hashnode.com/@lemon-and-ginger) · [Oct 15](https://hashnode.com/posts/devsecops-and-ai-part-2/6ad02f6f856dc7e6eda846f6) ### [DevSecOps and AI - Part 2](https://cyberology101.hashnode.dev/devsecops-and-ai-part-2?utm_source=hashnode&utm_medium=feed) Customising Semgrep Rules 8 min read · [cyberology101.hashnode.dev](https://cyberology101.hashnode.dev/devsecops-and-ai-part-2?utm_source=hashnode&utm_medium=feed) [Lemon and Ginger](https://hashnode.com/@lemon-and-ginger) · [Oct 1](https://hashnode.com/posts/devsecops-and-ai/6abe03f5512846453c61b86a) ### [DevSecOps and AI](https://cyberology101.hashnode.dev/devsecops-and-ai?utm_source=hashnode&utm_medium=feed) Integrating SAST into a Gitlab CI/CD Pipeline 5 min read · [cyberology101.hashnode.dev](https://cyberology101.hashnode.dev/devsecops-and-ai?utm_source=hashnode&utm_medium=feed) [Paul MK](https://hashnode.com/@paulappsec) · [Aug 17](https://hashnode.com/posts/semgrep-rules-i-never-ran/6a8349300aa58983de2c4754) ### [I wrote four Semgrep rules and never ran them. Two were broken.](https://paulappsec.hashnode.dev/semgrep-rules-i-never-ran?utm_source=hashnode&utm_medium=feed) Four Semgrep rules, carefully reasoned and never executed. Running them found two defects — including one rule that fired on the remediated code. 7 min read · [paulappsec.hashnode.dev](https://paulappsec.hashnode.dev/semgrep-rules-i-never-ran?utm_source=hashnode&utm_medium=feed) [DevTools Guide](https://hashnode.com/@devtoolsguide) · [Mar 4](https://hashnode.com/posts/semgrep-find-real-bugs-with-pattern-based-static-analysis/69a826ae9ac90ede164273f2) ### [Semgrep: Find Real Bugs with Pattern-Based Static Analysis](https://devtoolsguide.hashnode.dev/semgrep-find-real-bugs-with-pattern-based-static-analysis?utm_source=hashnode&utm_medium=feed) Most linters catch style problems. Semgrep catches real bugs: SQL injection, hardcoded secrets, insecure deserialization, SSRF vulnerabilities, and misuse of cryptographic APIs. It works on source code using pattern matching that understands syntax —... 5 min read · [devtoolsguide.hashnode.dev](https://devtoolsguide.hashnode.dev/semgrep-find-real-bugs-with-pattern-based-static-analysis?utm_source=hashnode&utm_medium=feed) [DevTools Guide](https://hashnode.com/@devtoolsguide) · [Mar 3](https://hashnode.com/posts/static-analysis-beyond-linting-codeql-semgrep-sonarqube-and-snyk-code/69a65673f5839ab8d765d811) ### [Static Analysis Beyond Linting: CodeQL, Semgrep, SonarQube, and Snyk Code](https://devtoolsguide.hashnode.dev/static-analysis-beyond-linting-codeql-semgrep-sonarqube-and-snyk-code?utm_source=hashnode&utm_medium=feed) Static Analysis Beyond Linting: CodeQL, Semgrep, SonarQube, and Snyk Code Linters enforce style. Static analysis finds bugs. The difference matters. ESLint will tell you about unused variables and inconsistent formatting. CodeQL will tell you that us... 8 min read · [devtoolsguide.hashnode.dev](https://devtoolsguide.hashnode.dev/static-analysis-beyond-linting-codeql-semgrep-sonarqube-and-snyk-code?utm_source=hashnode&utm_medium=feed) [GitHubOpenSource](https://hashnode.com/@GitHubOpenSource) · [Dec 16, 2025](https://hashnode.com/posts/stop-supply-chain-attacks-guarddog-scans-your-dependencies-for-hidden-malware/6941603e7d1af2ff68ad9ba3) ### [Stop Supply Chain Attacks: GuardDog Scans Your Dependencies for Hidden Malware](https://github-open-source.hashnode.dev/stop-supply-chain-attacks-guarddog-scans-your-dependencies-for-hidden-malware?utm_source=hashnode&utm_medium=feed) 📝 Quick Summary: GuardDog is a command-line interface tool designed to detect malicious packages across various ecosystems including PyPI, npm, Go, GitHub Actions, and VSCode extensions. It employs both source code analysis using Semgrep rules and p... 3 min read · [github-open-source.hashnode.dev](https://github-open-source.hashnode.dev/stop-supply-chain-attacks-guarddog-scans-your-dependencies-for-hidden-malware?utm_source=hashnode&utm_medium=feed) [Hare Krishna Rai](https://hashnode.com/@harekrishnarai) · [Sep 4, 2025](https://hashnode.com/posts/from-grep-to-taint-analysis-the-evolution-of-static-code-scanning/68b9b3be260fb367ff14feec) ### [From Grep to Taint Analysis: The Evolution of Static Code Scanning](https://blog.harekrishnarai.me/from-grep-to-taint-analysis-the-evolution-of-static-code-scanning?utm_source=hashnode&utm_medium=feed) Explore the evolution of static code analysis, from simple string searches to advanced taint-aware tools like CodeQL and Checkmarx 5 min read · [blog.harekrishnarai.me](https://blog.harekrishnarai.me/from-grep-to-taint-analysis-the-evolution-of-static-code-scanning?utm_source=hashnode&utm_medium=feed)