Semgrep Rule Variant Creator

When to Use

• Extending an existing Semgrep rule to cover additional vulnerability patterns
• A rule catches one variant but misses similar patterns in different syntax
• Adapting rules from one framework/language to another
• Broadening detection after a specific vulnerability is found
• Creating a family of related rules from a single exemplar

When NOT to Use

• Writing rules from scratch (use semgrep-rule-creator)
• Complex cross-function data flow (use CodeQL)
• Rules for non-code files

Variant Creation Workflow

1. Analyze the Original Rule