[
  {
    "id": "semgrep-docs-1",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/getting-started/quickstart",
    "excerpt": "Learn how to set up Semgrep, scan your first project, which can be any codebase, repository, or folder within a monorepo, for security issues, and view your findings.",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-2",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/getting-started/cli",
    "excerpt": "To turn on cross-file analysis, which allows you to detect vulnerabilities across files and folders",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-3",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/getting-started/cli",
    "excerpt": "To export the results to a SARIF file:",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-4",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/overview",
    "excerpt": "you can write custom rules to determine what Semgrep detects in your repositories",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-5",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/overview",
    "excerpt": "you can write and test using the [Semgrep Editor]",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-6",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-code/overview",
    "excerpt": "With AI-Powered Detection, you can automatically identify complex business logic flaws, such as IDORs and broken authorization.",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-7",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-code/overview",
    "excerpt": "Semgrep Code is transparent; you can configure the rules it runs and inspect its syntax to understand how the finding was detected.",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-8",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-secrets/conceptual-overview",
    "excerpt": "Semgrep Secrets scans code to detect exposed API keys, passwords, and other credentials.",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-9",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-secrets/conceptual-overview",
    "excerpt": "valid secrets are those that have been tested against a web service and confirmed to successfully grant resources or authentication. They are actively in use.",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-10",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-secrets/conceptual-overview",
    "excerpt": "informs developers of valid secrets in their PRs and MRs by posting comments directly",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-11",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-supply-chain/overview",
    "excerpt": "If there's a code pattern in the codebase that matches the vulnerability definition, the finding is flagged as reachable.",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-12",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-supply-chain/overview",
    "excerpt": "Generate reports and software bills of materials (SBOM) that provide a complete inventory of your open source components",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-13",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-supply-chain/overview",
    "excerpt": "Supply Chain's Dynamic Dependency Resolution provides a complete inventory of your project's dependencies using a combination of manifest parsing and repository integration",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-14",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/deployment/add-semgrep-to-ci",
    "excerpt": "This guide walks you through creating a Semgrep job in the following CI providers, which are explicitly supported in Semgrep AppSec Platform",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-15",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/deployment/add-semgrep-to-ci",
    "excerpt": "consider Semgrep Managed Scans, which enables you to bulk onboard and scan your repositories without requiring changes to your CI",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-16",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/extensions/pre-commit",
    "excerpt": "The pre-commit framework can run semgrep when you commit changes. This is helpful in preventing secrets and security issues from leaking into your Git history.",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-17",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-appsec-platform/semgrep-api",
    "excerpt": "Semgrep AppSec Platform provides an API that enables you to list deployments, gather findings created by Semgrep AppSec Platform, and list projects.",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-gh-1",
    "tier": "github",
    "url": "https://github.com/semgrep/semgrep",
    "excerpt": "Semgrep would match x = 1; y = x + 1 when searching for 2",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-gh-2",
    "tier": "github",
    "url": "https://github.com/semgrep/semgrep",
    "excerpt": "Semgrep analyzes code locally on your computer or in your build environment: by default, code is never upload",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-18",
    "tier": "claimed-docs",
    "url": "https://semgrep.dev",
    "excerpt": "Ready to move off legacy AppSec? The New Shift Program helps you switch from Checkmarx or Snyk.",
    "fetchedAt": "2026-09-03T23:47:54.752Z"
  },
  {
    "id": "semgrep-docs-19",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/getting-started/quickstart",
    "excerpt": "navigate to the root of your project, and run your first scan: semgrep ci",
    "fetchedAt": "2026-09-03T23:49:28.220Z"
  },
  {
    "id": "semgrep-docs-20",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/getting-started/cli",
    "excerpt": "To export the results to a SARIF file: semgrep ci --sarif --sarif-output=semgrep.sarif",
    "fetchedAt": "2026-09-03T23:49:28.220Z"
  },
  {
    "id": "semgrep-docs-21",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/overview",
    "excerpt": "you can write rules that: Automate code review comments. Identify secure coding violations. Scan configuration files.",
    "fetchedAt": "2026-09-03T23:49:28.220Z"
  },
  {
    "id": "semgrep-docs-22",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-code/overview",
    "excerpt": "Triage findings\n*   Send alerts and notifications or create tickets to track findings identified by Semgrep Code",
    "fetchedAt": "2026-09-03T23:49:28.220Z"
  },
  {
    "id": "semgrep-docs-23",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-supply-chain/overview",
    "excerpt": "Detect malicious dependencies associated with Supply Chain attacks",
    "fetchedAt": "2026-09-03T23:49:28.220Z"
  },
  {
    "id": "semgrep-docs-24",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-supply-chain/overview",
    "excerpt": "If there’s a code pattern in the codebase that matches the vulnerability definition, the finding is flagged as reachable.",
    "fetchedAt": "2026-09-03T23:49:28.220Z"
  },
  {
    "id": "semgrep-docs-25",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/deployment/add-semgrep-to-ci",
    "excerpt": "your development cycle benefits from the automated scanning of repositories at various events, such as: Push events; Pull requests or merge requests",
    "fetchedAt": "2026-09-03T23:49:28.220Z"
  },
  {
    "id": "semgrep-docs-26",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/getting-started/quickstart",
    "excerpt": "pipx install semgrep\n\n# preferred: install through uv (https://docs.astral.sh/uv/)\nuv tool install semgrep",
    "fetchedAt": "2026-09-03T23:49:28.220Z"
  },
  {
    "id": "semgrep-docs-27",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/getting-started/cli",
    "excerpt": "semgrep scan - This is the recommended command for scanning local codebases or scanning a project when you don't have a Semgrep account",
    "fetchedAt": "2026-09-03T23:50:55.224Z"
  },
  {
    "id": "semgrep-docs-28",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/deployment/add-semgrep-to-ci",
    "excerpt": "your development cycle benefits from the automated scanning of repositories at various events, such as: Push events, Pull requests or merge requests",
    "fetchedAt": "2026-09-03T23:50:55.224Z"
  },
  {
    "id": "semgrep-docs-29",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-supply-chain/overview",
    "excerpt": "Semgrep Supply Chain is a software composition analysis (SCA) tool that detects security vulnerabilities in your codebase introduced by open source dependencies.",
    "fetchedAt": "2026-09-03T23:50:55.224Z"
  },
  {
    "id": "semgrep-docs-30",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-code/overview",
    "excerpt": "Triage findings\nSend alerts and notifications or create tickets to track findings identified by Semgrep Code",
    "fetchedAt": "2026-09-03T23:50:55.224Z"
  },
  {
    "id": "semgrep-gh-3",
    "tier": "github",
    "url": "https://github.com/semgrep/semgrep",
    "excerpt": "Contextual post-processing of findings with Semgrep Assistant (AI) to further reduce noise by ~20%",
    "fetchedAt": "2026-09-03T23:50:55.224Z"
  },
  {
    "id": "semgrep-docs-31",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/getting-started/quickstart",
    "excerpt": "Launch your CLI, and follow the instructions on the Scan a project on your",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-32",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/getting-started/cli",
    "excerpt": "Learn how to set up Semgrep, scan your project for security issues using Semgrep Code’s interfile analysis, and view your findings in the CLI.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-33",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/for-developers/cli.md",
    "excerpt": "The `--dry-run` flag ensures that your scans are not uploaded to the Semgrep web app.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-34",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/for-developers/cli.md",
    "excerpt": "You do **not** need to be logged in to run a scan.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-35",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/overview.md",
    "excerpt": "Automate code review comments.\n*   Identify secure coding violations.\n*   Scan configuration files.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-36",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/private-rules.md",
    "excerpt": "Users with Semgrep Code's Team or Enterprise tier can publish rules to the Semgrep Registry as private rules that are not visible to those outside their organization.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-37",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/testing-rules.md",
    "excerpt": "Semgrep provides a testing mechanism for your rules. You can write code and provide annotations to let Semgrep know where you are or aren't expecting findings.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-38",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/rule-defined-fix.md",
    "excerpt": "You can apply the Rule-defined fix directly to the file using the `--autofix` flag.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-39",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/generic-pattern-matching.md",
    "excerpt": "Semgrep can match generic patterns in languages that it does **not** yet support.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-40",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/metavariable-analysis.md",
    "excerpt": "Currently, this syntax supports two analyzers: `redos` and `entropy`.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-41",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/data-flow/data-flow-overview.md",
    "excerpt": "Taint tracking (known also as taint analysis) enables you to write simple rules that catch complex injection bugs, such as those that can result in cross-site scripting (XSS).",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-42",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/data-flow/constant-propagation.md",
    "excerpt": "Semgrep AppSec Platform supports interprocedural (cross-function), interfile (cross-file) constant propagation.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-43",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-secrets/conceptual-overview",
    "excerpt": "Semgrep saves security engineers time and effort by prioritizing valid leaked secrets and informs developer",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-44",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-supply-chain/overview",
    "excerpt": "Support the enforcement of your business’ open source package licensing requirements",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-45",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/deployment/add-semgrep-to-ci",
    "excerpt": "Semgrep is integrated into CI environments by creating a **job** that is run by the CI provider. After a scan, findings are sent to Semgrep AppSec Platform for triage and remediation.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-46",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/extensions/pre-commit",
    "excerpt": "The pre-commit framework can run `semgrep` when you commit changes. This is helpful in preventing secrets and security issues from leaking into your Git history.",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-47",
    "tier": "claimed-docs",
    "url": "https://semgrep.dev",
    "excerpt": "Scan and fix AI-generated code the moment it's written",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-48",
    "tier": "claimed-docs",
    "url": "https://semgrep.dev",
    "excerpt": "Combine AI reasoning with rule-based analysis for detection, triage, and remediation",
    "fetchedAt": "2026-09-16T20:59:31.712Z"
  },
  {
    "id": "semgrep-docs-49",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/_llms/scan-with-semgrep.md",
    "excerpt": "scan your first project, which can be any codebase, repository, or folder within a monorepo, for security issues, and view your findings",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-50",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/for-developers/cli.md",
    "excerpt": "You can run local Semgrep CLI scans with the Semgrep command-line tool.",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-51",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/for-developers/cli.md",
    "excerpt": "The --dry-run flag ensures that your scans are not uploaded to the Semgrep web app.",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-52",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/overview.md",
    "excerpt": "Semgrep uses rules, which encapsulate pattern matching logic and data flow analysis, to scan your code for security issues, style violations, bugs, and more.",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-53",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/rule-defined-fix.md",
    "excerpt": "You can apply the Rule-defined fix directly to the file using the --autofix flag.",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-54",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-secrets/conceptual-overview",
    "excerpt": "Semgrep Secrets scans code to detect exposed API ke",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-55",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-supply-chain/overview",
    "excerpt": "Semgrep Supply Chain is a software composition analysis (SCA) tool that detects security vulnerabilities in",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-56",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/extensions/pre-commit",
    "excerpt": "The pre-commit framework can run semgr",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-57",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/rule-ideas.md",
    "excerpt": "You can use Semgrep and its GitHub integration to automate PR comments that you frequently make in code reviews.",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-58",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/writing-rules/data-flow/taint-mode/overview.md",
    "excerpt": "Semgrep supports taint analysis, also known as taint tracking, through taint rules.",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-59",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-appsec-platform/semgrep-api",
    "excerpt": "Semgrep AppSec Platform provides an API that enables you to list deployments, gather findings created by Semgrep",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-docs-60",
    "tier": "claimed-docs",
    "url": "https://docs.semgrep.dev/semgrep-code/overview",
    "excerpt": "Semgrep Code is a static application security testing (SAST) tool that",
    "fetchedAt": "2026-09-16T21:02:58.037Z"
  },
  {
    "id": "semgrep-comm-1",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=26904951",
    "excerpt": "As a security consultant, I write custom Semgrep rules to match antipatterns unique to a codebase (e.g., controllers missing an authorization check). More flexible across languages than tools like Brakeman, and rulesets are readable. The curated per-language rules are also convenient for quick wins.",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-2",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=26904951",
    "excerpt": "Running the CI ruleset on a tiny Django hobby project spun all cores to 100% after 33% progress and made the OS almost unresponsive; had to ctrl-c and pkill every semgrep process. Never seen the M1 Airbook overheat this much before.",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-3",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=26904951",
    "excerpt": "Semgrep's parser complains that valid TypeScript using a typed catch clause (`catch (error: unknown)`) is invalid and can't be parsed.",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-4",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=26904951",
    "excerpt": "\"This is much better alternative to codeQL used by google and does not use a shameless registration-only model!\"",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-5",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=26904951",
    "excerpt": "The underlying tree-sitter parser Semgrep uses is amazing - parsing millions of files across JS, TS, Ruby, YAML, HTML, CSS in about half a minute, far faster than many JS-ecosystem tools.",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-6",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=26904951",
    "excerpt": "A simple Semgrep 'no-prints' rule can be trivially bypassed with a workaround like `import builtins; builtins.print(\"whee\")`, showing the tool can be worked around fairly easily despite AST-based matching.",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-7",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=23919313",
    "excerpt": "We've used Semgrep for Zulip's Python codebase for months and really appreciate the semantic checks, especially for security lint rules - it removes the hacky regex feel. Main complaint is performance: too slow per-rule to replace our whole-codebase regex-based linter (~100 rules).",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-8",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=23919313",
    "excerpt": "pip3 install semgrep fails on Windows 10 with Python 3.7.8/pip 20.1.1 due to an invalid path separator character error when copying semgrep-core.",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-9",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=24931985",
    "excerpt": "We've used semgrep since before it was called semgrep. It's ruthlessly effective as an exploratory/experimental tool but takes no effort to turn into a persistent check - unlike ripgrep (fast search but nobody writes linters with it) or bandit (doesn't help build a mental map of a codebase).",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-10",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=24931985",
    "excerpt": "Tried the Semgrep editor demo searching for exec(...) in Python; it failed to catch a simple aliasing workaround: `not_exec = exec; not_exec('rm -rf /')`.",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-11",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=33082064",
    "excerpt": "\"Sounds nice. I've never worked with a tool like this that doesn't turn up a ridiculous number of false positives.\"",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-12",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=33082064",
    "excerpt": "Regarding Semgrep Supply Chain: \"This is not open source, though? It does make a big difference for some whether you're able to run the check offline or you're forced to upload your code to some service.\"",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-13",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=43054673",
    "excerpt": "\"I just tried my latest task with it and o1 readily hallucinated non-existent semgrep functions.\"",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-comm-14",
    "tier": "community",
    "url": "https://news.ycombinator.com/item?id=43054673",
    "excerpt": "Built a tool using Semgrep's SARIF output plus prompted LLMs to help prioritize triage; used at Microsoft for the past year to help surface the 'most likely interesting' 5% of a large result set for human review - works quite well.",
    "fetchedAt": "2026-09-03T23:55:48.494Z"
  },
  {
    "id": "semgrep-probe-1",
    "tier": "probe",
    "url": "https://docs.semgrep.dev/llms.txt",
    "excerpt": "PROBE llms.txt: HTTP 200 at https://docs.semgrep.dev/llms.txt # Semgrep\n\n## Home\n\n- [Semgrep Docs](https://docs.semgrep.dev/index.md): Get started with Semgrep to help you catch, fla",
    "fetchedAt": "2026-09-16T21:03:20.834Z"
  },
  {
    "id": "semgrep-probe-2",
    "tier": "probe",
    "url": "https://docs.semgrep.dev/openapi.json",
    "excerpt": "PROBE openapi: all candidate paths 404 (https://docs.semgrep.dev/openapi.json, https://docs.semgrep.dev/swagger.json, https://docs.semgrep.dev/api/openapi.json, https://docs.semgrep.dev/.well-known/openapi.json)",
    "fetchedAt": "2026-09-16T21:03:20.834Z"
  },
  {
    "id": "semgrep-probe-3",
    "tier": "probe",
    "url": "https://docs.semgrep.dev/mcp",
    "excerpt": "official MCP server documented at https://docs.semgrep.dev/mcp",
    "fetchedAt": "2026-09-16T21:03:20.834Z"
  },
  {
    "id": "semgrep-probe-4",
    "tier": "probe",
    "url": "https://docs.semgrep.dev/getting-started/cli",
    "excerpt": "official CLI documented at https://docs.semgrep.dev/getting-started/cli",
    "fetchedAt": "2026-09-16T21:03:20.834Z"
  }
]