SAST Scan

Dependency audits cover code you imported; SAST covers code you wrote. It pattern-matches (and, with taint mode, traces dataflow) for the classic flaws: command/SQL injection, path traversal, unsafe deserialization, eval/dynamic exec on untrusted input, hardcoded crypto, missing auth checks. High false-positive rate is inherent — the discipline is triage by reachability, not blanket-ignore.

When to run

• Before a release, on the diff or the whole tree.
• When you add code that handles untrusted input (a new tool, an endpoint, a parser, a shell-out).
• In CI on PRs (diff-scoped, so it's fast and only flags new issues).

Run it

# semgrep — the security rulesets. `auto` picks rules from the detected languages.
semgrep scan --config auto --error .

# Focused, higher-signal rulesets (less noise than auto):
semgrep scan --config p/security-audit --config p/secrets --config p/command-injection .