#semgrep
Rulesets (43)
Vasilii ErmilovMost common clientside JavaScript XSS vulnerabilities
React security rules.
r2cCross-site scripting (XSS) secure defaults for Express.js
r2cRule pack for detecting insecure transport in node js
r2cSecure defaults for XSS in Go.
A collection of opinionated rules for best practices in popular languages. Recommended for users who want really strict coding standards.
r2cSecure defaults for XSS prevention for Ruby on Rails
r2cSecure defaults for XSS prevention
Find common bugs, errors, and logic issues in popular languages.
Colleen DaiEnsure your code communicates over encrypted channels instead of plaintext.
Selected rules from Hadolint, a Dockerfile linter, rewritten in Semgrep.
r2cSecure XSS defaults for HttpServlets+JSP.
r2cRule pack for detecting insecure transport in java spring.
r2cRule pack for detecting insecure transport in java stdlib.
Grayson HardawaySecurity checks for nginx configuration files.
r2cSecure defaults for XSS prevention in Django
r2cRule pack for detecting insecure transport in node js
Selected rules from Hadolint, a Dockerfile linter, rewritten in Semgrep.
Security checks for docker-compose configuration files.
Security checks for kubernetes configuration files.
Rules for linting Semgrep rule YAML files for errors or performance problems
Brakeman ruleset curated by Semgrep.
r2cOmni pack for insecure transport rules
r2cRule pack for detecting insecure transport in java spring.
electron desktop app
Vasilii ErmilovSecure defaults for Command injection prevention
Vasilii ErmilovInsecure usage of most popular headless browser APIs
r2cRuleset by r2c
Colleen DaiEnsure your code communicates over encrypted channels instead of plaintext.
Vasilii ErmilovSecure defaults for Command injection prevention
Vasilii ErmilovSecure defaults for Command injection prevention
Colleen DaiSQL injection guardrails. Checks for non-constant SQL queries and other SQLi.
PHP Laravel framework ruleset by Semgrep
Play framework ruleset by Semgrep
Vasilii ErmilovSecure defaults for Command injection prevention
React rules which contain best practices and general code-smells, should not be run in CI/CD.
React rules available to team tier customers, this rule-pack would be the most recommended due to higher accuracy of sources.
Rulset for reverse shells, by Kurt Boberg
Vasilii ErmilovSecure defaults for Command injection prevention
Secure defaults for XSS prevention for Ruby on Rails
Collection of rules preventing semgrep misconfigurations
Rule pack for detecting insecure transport in java spring.
Wordpress audit ruleset, ported from WPScan