SAST Scan with Semgrep

When to use

Prerequisites

• Semgrep CLI installed (

  pip install semgrep

  or

  brew install semgrep

  )
• Verify:

  semgrep --version

Instructions

1. Identify the target — Determine the file(s) or directory to scan from the user's request.
2. Select the ruleset — Choose the appropriate config:
   • General security:

     --config=auto

     (recommended default)
   • OWASP Top 10:

     --config=p/owasp-top-ten

   • Language-specific:

     --config=p/python

     ,

     --config=p/javascript

     ,

     --config=p/java

     , etc.
   • CI-focused:

     --config=p/ci

   • Secrets:

     --config=p/secrets

3. Run the scan:
   bash

   semgrep scan --config=auto --json --output=semgrep-results.json <target-path>

4. Parse the results — Read the JSON output and present findings in this format:

| # | Severity | Rule ID | File:Line | Finding | Remediation |
|---|----------|---------|-----------|---------|-------------|

1. Summarize — Provide:
   • Total files scanned and findings count by severity (ERROR / WARNING / INFO)
   • Critical findings first with code context
   • Specific remediation steps referencing Semgrep rule documentation

Common Rulesets

--config=auto

--config=p/owasp-top-ten

--config=p/secrets

--config=p/default

--config=p/ci