Flag	Purpose
`--config <cfg>`	Rule config: file, directory, URL, or registry rule (`p/...`)
`--lang <lang>`	Force language (python/javascript/java/go/etc.)
`--include <glob>`	Include only matching files
`--exclude <glob>`	Exclude matching files
`--severity <level>`	Filter: ERROR / WARNING / INFO
`--json`	JSON output
`--output <file>`	Save output to file
`--sarif`	SARIF format output (for GitHub/VS Code integration)
`--junit-xml`	JUnit XML output (for CI)
`--no-git-ignore`	Don't respect .gitignore
`--metrics off`	Disable telemetry
`--timeout <n>`	Per-file timeout (default 30s)
`--max-memory <n>`	Max memory per file (MB)
`-j <n>`	Parallelism (default: CPU count)
`--quiet`	Suppress non-finding output
`-v`	Verbose
`--validate`	Validate rules before running
`--test`	Test rules against test cases
`--autofix`	Apply auto-fixes where available
`--dryrun`	Show fixes without applying
`--pro`	Enable Pro engine (cross-file dataflow analysis)
`--exclude-rule <id>`	Skip specific rule ID
`--rewrite-rule-ids`	Prefix rule IDs with config path
`--scan-unknown-extensions`	Scan files with unknown extensions

Registry Rule Sets

Config	What it finds
`p/owasp-top-ten`	OWASP Top 10 vulnerabilities
`p/security-audit`	Broad security audit rules
`p/secrets`	Hardcoded API keys, tokens, passwords
`p/ci`	CI/CD configuration issues
`p/supply-chain`	Supply chain / dependency issues
`p/javascript`	JavaScript-specific security
`p/python`	Python security patterns
`p/java`	Java security patterns
`p/go`	Go security patterns
`p/php`	PHP security patterns
`p/react`	React-specific issues
`p/flask`	Flask web framework issues
`p/django`	Django web framework issues
`p/nodejs`	Node.js security patterns
`p/terraform`	Terraform IaC misconfigs
`p/dockerfile`	Dockerfile security issues
`p/kubernetes`	Kubernetes manifest issues
`p/sql-injection`	SQL injection patterns
`p/xss`	Cross-site scripting
`p/command-injection`	OS command injection
`p/ssrf`	Server-side request forgery
`p/jwt`	JWT misconfiguration
`p/crypto`	Weak cryptography patterns
`p/express`	Express.js security issues
`p/java-spring`	Spring Framework security
`p/insecure-transport`	HTTP instead of HTTPS, no TLS

Common Workflows

# Full security audit of a project
semgrep --config p/security-audit \
        --config p/secrets \
        --config p/owasp-top-ten \
        --severity WARNING \
        --json -o findings.json \
        /path/to/project

# Scan only Python files
semgrep --config p/python --include="*.py" .

# Scan for secrets (fast, high value)
semgrep --config p/secrets --quiet --json .

# Scan specific language
semgrep --config p/java --lang java src/

# Multiple configs
semgrep --config p/sql-injection \
        --config p/command-injection \
        --config p/xss \
        --json -o injection_findings.json .

# Exclude test files and dependencies
semgrep --config p/security-audit \
        --exclude="*test*" \
        --exclude="*vendor*" \
        --exclude="*node_modules*" \
        --exclude="*__pycache__*" \
        .

# Scan for insecure cryptography
semgrep --config r/generic.crypto .

# Scan IaC
semgrep --config p/terraform infra/
semgrep --config p/dockerfile Dockerfile
semgrep --config p/kubernetes k8s/

Output Parsing

# JSON output structure
semgrep --config p/secrets --json -o secrets.json .

# Extract findings:
cat secrets.json | jq '.results[] | {rule: .check_id, file: .path, line: .start.line, msg: .extra.message}'

# Count by severity:
cat findings.json | jq '[.results[].extra.severity] | group_by(.) | map({severity: .[0], count: length})'

# Find unique files with findings:
cat findings.json | jq -r '.results[].path' | sort -u

# High/critical only:
cat findings.json | jq '.results[] | select(.extra.severity == "ERROR") | {rule: .check_id, file: .path, line: .start.line}'

# SARIF output for GitHub Advanced Security:
semgrep --config p/security-audit --sarif -o results.sarif .

Writing Custom Rules

# rules/custom-sqli.yaml
rules:
  - id: raw-sql-from-input
    patterns:
      - pattern: |
          cursor.execute($QUERY + $USER_INPUT)
      - pattern-not: |
          cursor.execute($QUERY, ($PARAM,))
    message: "SQL query constructed from user input — potential SQLi"
    severity: ERROR
    languages: [python]
    metadata:
      category: security
      cwe: CWE-89

  - id: hardcoded-secret
    pattern-either:
      - pattern: |
          $KEY = "..."
          ...
          $API = $KEY
      - pattern: |
          password = "..."
    pattern-not:
      - pattern: |
          password = ""
    message: "Hardcoded secret detected"
    severity: WARNING
    languages: [python, javascript, java]

# rules/xss-flask.yaml
rules:
  - id: flask-render-string-unsafe
    patterns:
      - pattern: |
          flask.render_template_string($TMPL)
      - pattern-not: |
          flask.render_template_string("...")
    message: "render_template_string with variable — potential SSTI/XSS"
    severity: ERROR
    languages: [python]
    fix: |
      flask.render_template("safe_template.html")

# Test custom rule:
semgrep --config rules/ --validate
semgrep --config rules/custom-sqli.yaml /path/to/code

# Run all rules in directory:
semgrep --config ./rules/ .

High-Value Patterns for Code Review

# Find SQL concatenation (SQLi):
semgrep --config p/sql-injection --json .

# Find eval() usage:
semgrep -e 'eval(...)' --lang python .
semgrep -e 'eval(...)' --lang javascript .

# Find exec() in Python:
semgrep -e 'os.system(...)' --lang python .
semgrep -e 'subprocess.call($X, shell=True)' --lang python .

# Find hardcoded AWS keys:
semgrep -e '"AKIA..."' --lang generic .

# Find debug flags in production:
semgrep -e 'DEBUG = True' --lang python .
semgrep -e 'app.run(debug=True)' --lang python .

# Find JWT without verification:
semgrep -e 'jwt.decode($TOKEN, options={"verify_signature": False})' --lang python .

Resources

File	When to load
`references/rule-writing.md`	Custom rule patterns, metavariables, advanced matching

semgrep

semgrep

Quick Start

Core Flags