#semgrep
Rulesets (43)
Vasilii ErmilovMost common clientside JavaScript XSS vulnerabilities
r2cReact security rules.
r2cCross-site scripting (XSS) secure defaults for Express.js
r2cRule pack for detecting insecure transport in node js
r2cSecure defaults for XSS in Go.
r2cA collection of opinionated rules for best practices in popular languages. Recommended for users who want really strict coding standards.
r2cSecure defaults for XSS prevention for Ruby on Rails
r2cSecure defaults for XSS prevention
r2cFind common bugs, errors, and logic issues in popular languages.
Colleen DaiEnsure your code communicates over encrypted channels instead of plaintext.
r2cSelected rules from Hadolint, a Dockerfile linter, rewritten in Semgrep.
r2cSecure XSS defaults for HttpServlets+JSP.
r2cRule pack for detecting insecure transport in java spring.
r2cRule pack for detecting insecure transport in java stdlib.
Grayson HardawaySecurity checks for nginx configuration files.
r2cSecure defaults for XSS prevention in Django
r2cRule pack for detecting insecure transport in node js
r2cSelected rules from Hadolint, a Dockerfile linter, rewritten in Semgrep.
r2cSecurity checks for docker-compose configuration files.
r2cSecurity checks for kubernetes configuration files.
r2cRules for linting Semgrep rule YAML files for errors or performance problems
r2cBrakeman ruleset curated by r2c.
r2cOmni pack for insecure transport rules
r2cRule pack for detecting insecure transport in java spring.
r2celectron desktop app
Vasilii ErmilovSecure defaults for Command injection prevention
Vasilii ErmilovInsecure usage of most popular headless browser APIs
r2cRuleset by r2c
Colleen DaiEnsure your code communicates over encrypted channels instead of plaintext.
Vasilii ErmilovSecure defaults for Command injection prevention
Vasilii ErmilovSecure defaults for Command injection prevention
Colleen DaiSQL injection guardrails. Checks for non-constant SQL queries and other SQLi.
r2cPHP Laravel framework ruleset by r2c
r2cPlay framework ruleset by r2c
Vasilii ErmilovSecure defaults for Command injection prevention
r2cReact rules which contain best practices and general code-smells, should not be run in CI/CD.
r2cReact rules available to team tier customers, this rule-pack would be the most recommended due to higher accuracy of sources.
Rulset for reverse shells, by Kurt Boberg
Vasilii ErmilovSecure defaults for Command injection prevention
r2cSecure defaults for XSS prevention for Ruby on Rails
r2cCollection of rules preventing semgrep misconfigurations
r2cRule pack for detecting insecure transport in java spring.
r2cWordpress audit ruleset, ported from WPScan