How do you write and maintain custom Semgrep rules for your own codebase?
⚡
Quick Answer
Rules are YAML patterns that match on code structure (an AST), not text, so they survive formatting changes that break regex.
Detailed Answer
Rules are YAML patterns that match on code structure (an AST), not text, so they survive formatting changes that break regex. Write org-specific rules for your banned APIs and unsafe internal helpers, unit-test them with sample good/bad code, version them in a shared repo, and use metavariables and taint mode for source-to-sink dataflow rather than shallow pattern matches.
Code Example
# Deep-dive: Semgrep # writing and tuning custom rules, pattern syntax vs regex, per-language rulesets, autofix, baseline scanning on diffs only, false-positive suppression with nosemgrep, and running as a fast pre-commit and CI gate # apply the reasoning in the detailed answer to your own pipeline, # and prove it with a test/dry-run before enforcing in production
💡
Interview Tip
This is where depth shows — be concrete about Semgrep, not generic about "security".
semgrepdevsecopsdeep-dive