semgrep scan

semgrep --config auto <path>

Scans the code with semgrep using automatic rules, detecting vulnerabilities and insecure patterns in the repository.

Run it in the CI/CD pipeline when you want static analysis on every push: semgrep with --config auto uses community rules (those from the semgrep registry) on the repo's code and reports findings — vulnerabilities (injections, XSS, path traversal), insecure patterns, and bad practices. It's the reference open-source SAST: fast, no compilation, and with vendor rules (the registry with those from big companies). In DevSecOps, semgrep is the pipeline's first filter: the finding blocks the merge (or alerts) before code reaches production.

Don't use it as a complete analysis: semgrep detects the patterns from the rules — domain-specific vulnerabilities (business logic, architecture ones) require custom rules or manual analysis; and false positives from generic rules are triaged. The --config auto requires access to the registry (or cache): in isolated environments, rules are packaged. And note: SAST is static — it doesn't see runtime behavior (for that, DAST, 011) nor dependencies (for that, SCA, 019). semgrep is one piece of the pipeline; the combination with the rest is the complete program.