thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Application & OT Security · Intermediate

Semgrep

An open-source, pattern-based static analysis tool that scans code for bugs and security issues using rules that resemble source code.

Definition

Semgrep supports many languages, runs quickly in CI and IDEs and lets teams write custom rules to enforce their own secure coding standards. A commercial platform adds cross-file dataflow, supply chain and secrets scanning.

Example

A custom Semgrep rule flags any use of yaml.load without SafeLoader in Python code.

Exam tip

Lightweight SAST that is easy to customize for organization-specific rules.

Related terms