One Semgrep rule — its audit, its exclusions, its variants, its hunt
Paste the rule and, if you have one, the code it is meant to fire on.
Both examples ship with a saved model run for every lane, so you can see all four documents without signing in and without spending a credit.
What this does, and what it does not
The prescan is a real reader. The rule file is parsed by a YAML block parser covering the
subset Semgrep rules actually use — block mappings and sequences, flow collections like
languages: [python], single and double quoted scalars, and all five block-scalar
headers, so a message: >- folds and a pattern: | keeps its
newlines. The operator tree is then walked with polarity tracked, which is what makes the
quiet failures visible: Semgrep does not export a metavariable bound inside
pattern-not, so a metavariable-regex constraining one is a dead
constraint and the rule is wider than it reads. A patterns block containing only
negations can never match. A fix interpolating an unbound metavariable would
write the literal $X into someone's source.
Regexes are checked as PCRE rather than as JavaScript, because that is what Semgrep uses:
(?i) inline flags, \A anchors, atomic groups and
(?P<name>…) are all legal and are not reported as errors. Breadth is
measured, not guessed — concrete tokens counted against statement-level ellipses, inline
ellipses and disjunction branches — because f($X, ...) is idiomatic while a bare
... line is what turns a rule into a shape matcher.
Everything it finds is handed to the model as facts it must reconcile, and the reply is checked against them afterwards — if a flag goes unanswered, this page says which one. The page reads; it never executes a rule, never runs Semgrep, and never touches your repository. A credential in a test sample is already exposed: those are masked in your browser before anything is sent, and the right response is to rotate them and stop committing them.
Nothing to hand? Load the ,
a plausible Python rule with a real sample and annotations, or the
,
whose metavariable-regex names a metavariable no positive pattern binds and whose
autofix would write a literal $SINK into the source. Both replay a saved run in
every lane, for free.