Lion Cipher Lab

Review your own code for security with Semgrep (SAST)

• AppSec / DevSecOps
• Beginner
• ~35 min
• Free · no account required

Why it matters

Most security bugs are written, not deployed by accident — they start as a specific line of code: a shell command built by pasting in user input, a password hardcoded in the source, an unsafe deserialization call. SAST (static application security testing) reads your source WITHOUT running it and flags those known-insecure patterns before they ship. Semgrep is a free, open-source SAST tool that matches your code against rules — small pattern definitions grouped into rulesets like p/security-audit and p/owasp-top-ten — and points at the exact file and line. Learning to run it on your own…

What you'll learn

• what SAST (static application security testing) is and what it can and cannot find
• the vocabulary: rule, ruleset, false positive, false negative, injection
• installing and running Semgrep (free, open source) on your own repository
• scanning with community rulesets (p/security-audit, p/owasp-top-ten)
• reading a finding (rule id, file, line, why) and fixing an insecure pattern
• writing a tiny custom Semgrep rule for a pattern you care about

Steps in this lab

1. What SAST is, in one breath
2. Semgrep, and the words rule and ruleset
3. Install Semgrep
4. Scan your own repository with community rulesets
5. Read a finding: rule, file, line, why
6. Fix one finding (an injection or a hardcoded secret)
7. Write a tiny custom rule
8. The honest limits: what SAST does and does not do

Open the full interactive lab →