Hands-on playbook · 60 min
Semgrep Playbook: Write, Test and Ship Your Own Security Rules
A hands-on Semgrep deep dive: turn a real bug into a pattern rule and a taint rule, test both with annotated files, add an autofix, control what gets scanned, gate pull requests with SARIF, and run a rule programme that developers trust. Every rule on this page was run with semgrep --test.
- Turn one injection bug into a rule that finds every copy across your code
- Write a taint rule that follows request data to a shell command, with a sanitiser
- Test rules with ruleid and ok annotations, the way Semgrep's own rules are tested
- Add an autofix and a fix test so the rule repairs code safely
- Control scanning with .semgrepignore v2 and reviewed nosemgrep comments
- Gate pull requests with semgrep ci and upload SARIF to code scanning
- Run a rule programme: precision targets, blocking tiers and rule ownership
- 01Under the hood
- 02Hands-on lab
- 03Recipes
- 04Reviewing a rule before it ships
- 05Rollout runbook
- 06Troubleshooting
- 07Interview drill
- 08Sources
Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, hands-on tool playbooks, the complete practice-test bank, and the downloadable security field guides.
6 months · One payment · No auto-renewal
An independent playbook for interview preparation and learning. AISecurityInterviews is not affiliated with or endorsed by Semgrep, Inc., and product names are trademarks of their owners. Use these procedures only on systems you own or are authorised to test, and check the vendor's documentation before changing production.