Skip to content

Pull requests: semgrep/semgrep-rules

New pull request New
135 Open 3,199 Closed
135 Open 3,199 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Reviews
Filter by reviews
No reviews Review required Approved review Changes requested
Assignee
Filter by who’s assigned
Assigned to nobody Loading
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Pull requests list

Add mcp-credential-destination-injection-python rule
#4043 opened Aug 20, 2026 by SyedAnas01 Loading…
2 tasks done
5
Exclude $/ self-repository refs from action pinning rules
#4042 opened Aug 19, 2026 by nopcorn Loading…
1
fix(generic-api-key): exclude pnpm-workspace.yaml
#4041 opened Aug 19, 2026 by MgmClientGuy Loading…
1
python/flask: catch inline render_template_string() calls in dangerous-template-string
#4040 opened Aug 18, 2026 by shmulc8 Loading…
11
feat(python): add static detection rules for un-gated AI agent tool execution and excessive agency
#4039 opened Aug 17, 2026 by AAH20 Loading…
1
fix(docker-compose): support files without version
#4037 opened Aug 8, 2026 by fyrsta7 Loading…
1
2
fix(java): catch permissive file permission APIs
#4034 opened Aug 2, 2026 by 0xTaoZ Loading…
1
Add tarfile-unsafe-extraction rule (CWE-22 tarslip)
#4033 opened Jul 31, 2026 by rahulreddykarne Loading…
2
Merge Develop into Release
#4032 opened Jul 30, 2026 by r2c-argo Bot Loading…
Fix Renovate minimum release age exception
#4029 opened Jul 28, 2026 by Eljees Loading…
1
fix(java): avoid eqeq false positives on null checks
#4028 opened Jul 28, 2026 by 0xTaoZ Loading…
1
2
fix(java): recognize SharedSessionContract in hibernate-sqli
#4027 opened Jul 28, 2026 by Eljees Loading…
fix(java): catch chained ProcessBuilder command injection
#4026 opened Jul 28, 2026 by Eljees Loading…
1
5
fix(django): let django-no-csrf-token span realistic form bodies
#4025 opened Jul 28, 2026 by Eljees Loading…
1
5
fix(java): treat ACCESS_EXTERNAL_DTD as an XXE sanitizer
#4024 opened Jul 28, 2026 by Eljees Loading…
7
fix(java): detect String.formatted() in jdo-sqli
#4023 opened Jul 28, 2026 by Eljees Loading…
1
7
fix(c): describe the real hazard in insecure-use-strtok-fn
#4022 opened Jul 27, 2026 by Eljees Loading…
1
6
fix(gha): run-shell-injection flags the truthiness-check shape on bare inputs
#4020 opened Jul 27, 2026 by munzzyy Loading…
fix(java/jdo-sqli): detect String.formatted() as a tainted query source
#4016 opened Jul 24, 2026 by rayair250-droid Loading…
1
1
fix: resolve false negative in asyncpg-sqli rule by migrating to taint mode
#4014 opened Jul 23, 2026 by anannayamustcode Loading…
1
2
Fix uv cooldown rule with brackets in TOML sections
#4011 opened Jul 20, 2026 by Eljees Loading…
1
12
fix(gha): skip non-bash shells in curl nested-bash rules
#4005 opened Jul 16, 2026 by alexchen-sys Loading…
2 tasks done
1
2
fix(terraform): allow AWS FIPS TLS policies in insecure-load-balancer-tls-version
#4003 opened Jul 14, 2026 by sbruton Loading…
1
New Published Rules - ka_beraoud_esi_dz.limit-overrun-race-condition
#4000 opened Jul 12, 2026 by semgrep-dev-pr-bot Bot Loading…
renovate: don't flag packageRules covered by a top-level minimumReleaseAge
#3999 opened Jul 10, 2026 by munzzyy Loading…
1
1
ProTip! Mix and match filters to narrow down what you’re looking for.