Between 10 and 12 November, an attacker used GitHub tokens stolen in earlier breaches to push a secret stealer into tens of ...

Semgrep Mandoline gives AI agents fast program analysis across 50 languages, so they spend tokens reasoning about code ...

Semgrep Guardian now applies org-wide policies, adds AI detection for IDOR and malicious code, blocks risky lockfile changes, ...

In September incident responders were inundated with breaches all resulting from the npm supply chain. One of these attacks “Shai-Hulud” was a self replicating worm that affected over 180 packages in ...

Our new monthly look at what Semgrep shipped and why. This month: what we built when six incidents hit in one day, and everything else that shipped in October. On October 21, six security incidents ...

We thought it would be helpful to share some best practices for dev teams creating command-line security tools with cross-platform requirements. When updating Semgrep Community Edition for first-class ...

C# fans, rejoice! We’re very excited to announce that C# support is now generally available in Semgrep! Semgrep’s parse rate for C# is now over 99.9% and there are now more than 20 C# rules online in ...

TL;DR: We continue our previous research in evaluating Claude Code and OpenAI Codex on finding vulnerabilities in real, open-source applications, with simple prompts and no scaffolding. In this post ...

Forrester has named Semgrep a Strong Performer in the first edition of The Forrester Wave™: Agentic Development Security ...

AI agents are writing code now. That part is settled. The question security teams should be asking is: how do you make those agents write secure code from the start, rather than trying to catch ...