semgrep

# Semgrep Security Scan Run a Semgrep scan with automatic language detection, parallel execution across language groups, and merged SARIF output. ## Essential Principles 1. **Always use `--metrics=off`** — Semgrep sends telemetry by default; `--config auto` also phones home. Every `semgrep` command must include `--metrics=off` to prevent data leakage during security audits. 2. **User must approve the scan plan (Step 3 is a hard gate)** — The original "scan this codebase" request is NOT approval. Present exact rulesets, target, engine, and mode; wait for explicit "yes"/"proceed" before running scanners. 3. **Third-party rulesets are required, not optional** — Trail of Bits, 0xdea, and Decurity rules catch vulnerabilities absent from the official registry. Include them whenever the detected language matches. 4. **Run all scan workers in parallel** — Parallel execution is the core performance advantage. Do not run language scans strictly one-after-another when independence allows overlap. 5. **Always check for Semgrep Pro before scanning** — Pro enables cross-file taint tracking and catches ~250% more true positives. Skipping the check means silently missing critical inter-file vulnerabilities. ## When to Use - Security audit of a codebase - Finding vulnerabilities before code review - Scanning for known bug patterns - First-pass static analysis ## When NOT to Use - Binary analysis → Use binary analysis tools - Already have Semgrep CI configured → Use existing pipeline - ...