Vetrix Docs

Semgrep

  • Category: sast (polyglot)
  • Fingerprint: rule-file-surrounding-3-lines-v1 (rewritten by RewriteSemgrepSARIF so its own partialFingerprints are preserved under scanner/semgrep/* for triage).
  • License: LGPL-2.1 (CE; Vetrix uses the community edition only).

Semgrep's pattern language is the most expressive SAST surface we ship. The ruleset count is intentionally narrow by default — p/security-audit and p/owasp-top-ten — to keep the noise floor low.

sast:
  semgrep:
    enabled: true
    rulesets: [p/security-audit, p/owasp-top-ten]

Authoring your own rules

Commit a .vetrix/rules/ directory and reference it:

sast:
  semgrep:
    rulesets: [p/security-audit, .vetrix/rules/acme-security.yml]

Common false positives

  • Language-agnostic rules over-match on shell pipelines. Disable the ruleset on scripts/ via a path override.
  • Dataflow rules emit on code that is unreachable from your main entry points — Semgrep does not have a real call graph.