Skip to content

Pull requests: semgrep/semgrep-rules

New pull request New
135 Open 3,193 Closed
135 Open 3,193 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

fix(java): catch permissive file permission APIs
#4034 opened Aug 2, 2026 by 0xTaoZ Loading…
1
Add tarfile-unsafe-extraction rule (CWE-22 tarslip)
#4033 opened Jul 31, 2026 by rahulreddykarne Loading…
2
Merge Develop into Release
#4032 opened Jul 30, 2026 by r2c-argo Bot Loading…
Fix Renovate minimum release age exception
#4029 opened Jul 28, 2026 by Eljees Loading…
1
fix(java): avoid eqeq false positives on null checks
#4028 opened Jul 28, 2026 by 0xTaoZ Loading…
1
2
fix(java): recognize SharedSessionContract in hibernate-sqli
#4027 opened Jul 28, 2026 by Eljees Loading…
fix(java): catch chained ProcessBuilder command injection
#4026 opened Jul 28, 2026 by Eljees Loading…
1
4
fix(django): let django-no-csrf-token span realistic form bodies
#4025 opened Jul 28, 2026 by Eljees Loading…
1
4
fix(java): treat ACCESS_EXTERNAL_DTD as an XXE sanitizer
#4024 opened Jul 28, 2026 by Eljees Loading…
6
fix(java): detect String.formatted() in jdo-sqli
#4023 opened Jul 28, 2026 by Eljees Loading…
1
6
fix(c): describe the real hazard in insecure-use-strtok-fn
#4022 opened Jul 27, 2026 by Eljees Loading…
1
5
fix(gha): run-shell-injection flags the truthiness-check shape on bare inputs
#4020 opened Jul 27, 2026 by munzzyy Loading…
fix(java/jdo-sqli): detect String.formatted() as a tainted query source
#4016 opened Jul 24, 2026 by rayair250-droid Loading…
1
1
fix: resolve false negative in asyncpg-sqli rule by migrating to taint mode
#4014 opened Jul 23, 2026 by anannayamustcode Loading…
1
2
Fix uv cooldown rule with brackets in TOML sections
#4011 opened Jul 20, 2026 by Eljees Loading…
1
10
fix(gha): skip non-bash shells in curl nested-bash rules
#4005 opened Jul 16, 2026 by l46983284-cpu Loading…
2 tasks done
1
2
fix(terraform): allow AWS FIPS TLS policies in insecure-load-balancer-tls-version
#4003 opened Jul 14, 2026 by sbruton Loading…
1
New Published Rules - ka_beraoud_esi_dz.limit-overrun-race-condition
#4000 opened Jul 12, 2026 by semgrep-dev-pr-bot Bot Loading…
renovate: don't flag packageRules covered by a top-level minimumReleaseAge
#3999 opened Jul 10, 2026 by munzzyy Loading…
1
1
Remove obsolete rule javascript.lang.correctness.no-replaceall
#3998 opened Jul 10, 2026 by munzzyy Loading…
1
1
Add ML deserialization rules (torch.load, joblib, pandas.read_pickle,…
#3992 opened Jul 8, 2026 by DipesThapa Loading…
1
2
Detect insecure BuildKit RUN steps
#3991 opened Jul 8, 2026 by theinfosecguy Contributor Loading…
Add FastAPI TrustedHost rule
#3989 opened Jul 6, 2026 by theinfosecguy Contributor Loading…
Improve FastAPI CORS coverage
#3988 opened Jul 6, 2026 by theinfosecguy Contributor Loading…
New Published Rules - help_marketingtool_pro.detected-sonarqube-docs-api-key-copy
#3987 opened Jul 5, 2026 by semgrep-dev-pr-bot Bot Loading…
ProTip! Follow long discussions with comments:>50.