Scan source code for vulnerabilities with pattern-based rules

Semgrep matches bug and vulnerability patterns written in a syntax that mirrors the code itself, so a rule for a dangerous call reads like the snippet it catches instead of a dense regex. It parses each file into a syntax tree and matches structurally, which means one rule holds across formatting and variable names, and it ships curated registry packs for common security issues in dozens of languages.

Rule selection is the main dial. Pass --config with a registry pack like p/python, a local YAML file, a URL, or --config auto to pull rules tailored to the project. Pick an output format next: --sarif for code-scanning dashboards, --json for pipelines, or GitLab SAST and JUnit XML. Add --error so a nonzero exit fails a build when findings appear, and use --exclude or --include to keep the scan on the paths you care about.

In a Trickest workflow the scan runs against a checked-out repository and writes its findings as a file and a folder, so the triage and reporting path that already handles dynamic-scanner output also carries these static results. Because every rule is a pattern, encoding a newly found bug variant as a reusable check takes minutes, not a plugin build.