semgrep

Select rules for the repository's languages and trust boundaries, save structured output, and trace matches along executable paths. Pass every material candidate to /verify-security-finding.

Complete when every material match is verified, rejected, or recorded with the missing reachability evidence.