sast-semgrep

name	sast-semgrep
description	Static application security testing (SAST) using Semgrep for vulnerability detection, security code review, and secure coding guidance with OWASP and CWE framework mapping. Use when: (1) Scanning code for security vulnerabilities across multiple languages, (2) Performing security code reviews with pattern-based detection, (3) Integrating SAST checks into CI/CD pipelines, (4) Providing remediation guidance with OWASP Top 10 and CWE mappings, (5) Creating custom security rules for organization-specific patterns, (6) Analyzing dependencies for known vulnerabilities.
version	0.1.0
maintainer	SirAppSec
category	appsec
tags	["sast","semgrep","vulnerability-scanning","code-security","owasp","cwe","security-review"]
frameworks	["OWASP","CWE","SANS-25"]
dependencies	{"python":">=3.8","packages":["semgrep"],"tools":["git"]}
references	["https://semgrep.dev/docs/","https://owasp.org/Top10/","https://cwe.mitre.org/"]

SAST with Semgrep

Overview

Perform comprehensive static application security testing using Semgrep, a fast, open-source static analysis tool. This skill provides automated vulnerability detection, security code review workflows, and remediation guidance mapped to OWASP Top 10 and CWE standards.

Quick Start

Scan a codebase for security vulnerabilities:

semgrep --config=auto --severity=ERROR --severity=WARNING /path/to/code

Run with OWASP Top 10 ruleset:

semgrep --config="p/owasp-top-ten" /path/to/code

Core Workflows

Workflow 1: Initial Security Scan

1. Identify the primary languages in the codebase
2. Run scripts/semgrep_scan.py with appropriate rulesets
3. Parse findings and categorize by severity (CRITICAL, HIGH, MEDIUM, LOW)
4. Map findings to OWASP Top 10 and CWE categories
5. Generate prioritized remediation report

Workflow 2: Security Code Review

1. For pull requests or commits, run targeted scans on changed files
2. Use semgrep --diff to scan only modified code
3. Flag high-severity findings as blocking issues
4. Provide inline remediation guidance from references/remediation_guide.md
5. Link findings to secure coding patterns

Workflow 3: Custom Rule Development

1. Identify organization-specific security patterns to detect
2. Create custom Semgrep rules in YAML format using assets/rule_template.yaml
3. Test rules against known vulnerable code samples
4. Integrate custom rules into CI/CD pipeline
5. Document rules in references/custom_rules.md

Workflow 4: CI/CD Integration

1. Add Semgrep to CI/CD pipeline using assets/ci_config_examples/
2. Configure baseline scanning for pull requests
3. Set severity thresholds (fail on CRITICAL/HIGH)
4. Generate SARIF output for security dashboards
5. Track metrics: vulnerabilities found, fix rate, false positives

Security Considerations

• Sensitive Data Handling: Semgrep scans code locally; ensure scan results don't leak secrets or proprietary code patterns. Use --max-lines-per-finding to limit output.