semgrep

Static analysis for security — find vulns, secrets, misconfigs in source code.

Quick Start

# Modern syntax: semgrep scan (older: semgrep --config)
semgrep scan --config p/owasp-top-ten .

# Scan for secrets
semgrep --config p/secrets .

# Full security audit
semgrep --config p/security-audit .

Core Flags