Semgrep Static Analysis: Custom Rules, CI Integration & SAST Guide

Semgrep is a fast, open-source SAST tool that finds bugs and security vulnerabilities using pattern-based rules. Unlike regex, Semgrep understands code structure — making it easy to write precise custom rules for your codebase and integrate security checks directly into CI/CD pipelines.

What is Semgrep vs Other SAST Tools?

Traditional SAST tools like Fortify or Checkmarx use complex data-flow analysis — powerful but slow and hard to customize. Semgrep takes a different approach: lightweight syntactic pattern matching against the AST. This makes it fast enough to run on every PR, easy to write custom rules for, and flexible enough to catch business-logic bugs alongside security vulnerabilities.

Semgrep is fully open-source (OSS tier). Semgrep Code (cloud) adds cross-file taint analysis and a web dashboard for team management.

Installation and Quickstart

# Install via pip
pip install semgrep

# Or via Homebrew
brew install semgrep

# Run with auto-selected rules for your languages
semgrep --config=auto .

# Run a specific ruleset
semgrep --config=p/nodejs .

# Run against a single file
semgrep --config=auto src/auth.js

Using Community Rulesets

# Auto-detect language and apply best rulesets
semgrep --config=auto .

# Security-focused rulesets
semgrep --config=p/owasp-top-ten .
semgrep --config=p/nodejs .
semgrep --config=p/python .
semgrep --config=p/django .
semgrep --config=p/react .

# Secret detection
semgrep --config=p/secrets .

# Multiple configs
semgrep --config=p/nodejs --config=p/jwt .

Writing Custom Rules

Rules are YAML files. Here's a rule that catches SQL injection via string concatenation in Python:

rules:
  - id: sql-injection-string-concat
    pattern: |
      cursor.execute("..." + $USER_INPUT)
    message: |
      SQL injection risk: do not concatenate user input into queries.
      Use parameterized queries: cursor.execute("SELECT ...", (value,))
    languages: [python]
    severity: ERROR
    metadata:
      category: security
      cwe: CWE-89

  - id: hardcoded-aws-secret
    pattern-either:
      - pattern: |
          $KEY = "AKIA..."
      - pattern: |
          aws_secret_access_key = "..."
    message: Hardcoded AWS credentials detected
    languages: [python, javascript, typescript]
    severity: ERROR

CI Integration — GitHub Actions

name: Semgrep SAST

on:
  push:
    branches: [main]
  pull_request:

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container:
      image: semgrep/semgrep
    steps:
      - uses: actions/checkout@v4

      - name: Run Semgrep
        run: |
          semgrep \
            --config=auto \
            --sarif \
            --output=semgrep.sarif \
            --error
        env:
          SEMGREP_APP_TOKEN: {{ secrets.SEMGREP_APP_TOKEN }}

      - name: Upload SARIF
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: semgrep.sarif

Detecting Common Security Issues

Semgrep vs SonarQube vs CodeQL