Writing a Simple Custom Rule<\/strong><\/h2>\n\n\n\nOne of the most powerful parts of this Semgrep static analysis tutorial is that you are not limited to pre-written rules. You can write your own in a few lines of YAML.<\/p>\n\n\n\n
Here is a simple rule that flags any use of Python’s dangerous eval()<\/strong> function:<\/p>\n\n\n\nrules:\n - id: no-eval\n pattern: eval(...)\n message: Avoid using eval(), it can execute arbitrary code.\n languages: [python]\n severity: WARNING\n<\/code><\/pre>\n\n\n\nSave this as rule.yaml<\/strong> and run it with:<\/p>\n\n\n\nsemgrep –config rule.yaml .<\/strong><\/p>\n\n\n\nNotice the pattern looks just like real Python code, with …<\/strong> acting as a wildcard for any arguments. This is what makes Semgrep approachable, you are pattern-matching code, not writing complex parsing logic.<\/p>\n\n\n\nAdding Semgrep to GitHub Actions<\/strong><\/h2>\n\n\n\nOnce you are comfortable running scans locally, the natural next step in any Semgrep static analysis tutorial is automating it. Add this file as .github\/workflows\/semgrep.yml<\/strong>:<\/p>\n\n\n\nname: Semgrep Scan\non: [pull_request]\njobs:\n semgrep:\n runs-on: ubuntu-latest\n steps:\n - uses: actions\/checkout@v4\n - uses: semgrep\/semgrep-action@v1\n with:\n config: auto\n<\/code><\/pre>\n\n\n\nNow every pull request automatically triggers a scan, and findings can appear directly as comments on the PR, catching issues before a human reviewer even looks at the code.<\/p>\n\n\n\n
\n
\ud83d\udca1 Did You Know?<\/h3>\n \n - Semgrep scans over 100 million lines of code daily across its global user base, making it one of the most widely adopted static analysis tools in modern software development. Leading technology companies such as Dropbox, Figma, Snowflake, and HashiCorp use Semgrep in their development and security pipelines. Despite operating at massive scale, the open-source engine featured in this Semgrep static analysis tutorial remains completely free for developers and organizations to use.<\/li>\n <\/ul>\n<\/div>\n\n\n\n
Common Mistakes to Avoid<\/strong><\/h2>\n\n\n\n\n- Enabling every rule on day one.<\/strong> Running the full security-audit ruleset on a large codebase can return hundreds of findings instantly, overwhelming teams. Start with –config auto<\/strong> and expand gradually.<\/li>\n\n\n\n
- Treating every finding as urgent.<\/strong> Triage by severity first. Chasing INFO-level suggestions before fixing ERROR findings wastes momentum.<\/li>\n\n\n\n
- Skipping CI integration.<\/strong> Running Semgrep manually once is useful, but real value comes from catching issues automatically on every future pull request.<\/li>\n<\/ul>\n\n\n\n
Conclusion<\/strong><\/h2>\n\n\n\nThis Semgrep static analysis tutorial covered everything you need to start catching bugs before they ship: installing the CLI, running your first scan, reading results by severity, writing a basic custom rule, and automating scans through GitHub Actions. Static analysis is most powerful when it becomes a habit, not a one-time check. Run it locally as you code, and let CI catch anything you missed.<\/p>\n\n\n\n
FAQs<\/strong><\/h2>\n\n\n\n
\n
\n
1. Is Semgrep free to use?<\/strong><\/h3>\n\n\n
Yes. The Semgrep CLI covered in this tutorial is completely free, no account required to scan code locally.<\/p>\n\n<\/div>\n<\/div>\n
\n
2. What languages does Semgrep support?<\/strong><\/h3>\n\n\n
Over 30 languages including Python, JavaScript, TypeScript, Java, Go, C#, and Ruby.<\/p>\n\n<\/div>\n<\/div>\n
\n
3. Does Semgrep upload my code anywhere?<\/strong><\/h3>\n\n\n
No. Scans run entirely on your local machine or build environment.<\/p>\n\n<\/div>\n<\/div>\n
\n
4. How is Semgrep different from other static analysis tools?<\/strong><\/h3>\n\n\n
Its rules look like the actual code you write instead of complex regex, making it far easier to read, write, and customize.<\/p>\n\n<\/div>\n<\/div>\n
\n
5. Can I write my own Semgrep rules?<\/strong><\/h3>\n\n\n
Yes, in simple YAML files with a pattern that mirrors real code syntax, as shown in the custom rule example above.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"
Bugs and vulnerabilities are easier to fix the moment you write them, not weeks later in production. This Semgrep static analysis tutorial shows you how to catch issues right in your terminal, before you even open a pull request. By the end, you will have it installed, run a real scan, and understand what the […]<\/p>\n","protected":false},"author":65,"featured_media":120866,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[621],"tags":[],"views":"34","authorinfo":{"name":"Jebasta","url":"https:\/\/www.guvi.in\/blog\/author\/jebasta\/"},"thumbnailURL":"https:\/\/www.guvi.in\/blog\/wp-content\/uploads\/2026\/06\/Semgrep-Static-Analysis-300x116.webp","_links":{"self":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/118273"}],"collection":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/users\/65"}],"replies":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/comments?post=118273"}],"version-history":[{"count":2,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/118273\/revisions"}],"predecessor-version":[{"id":120868,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/posts\/118273\/revisions\/120868"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media\/120866"}],"wp:attachment":[{"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/media?parent=118273"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/categories?post=118273"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.guvi.in\/blog\/wp-json\/wp\/v2\/tags?post=118273"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}