Semgrep

Overview

Semgrep (and OpenGrep) uses YAML rules to find code patterns via Abstract Syntax Tree matching. Rules detect vulnerabilities, anti-patterns, and policy violations in application code, IaC, and config files.

Capabilities

Pattern matching with metavariables ($VAR, ...)
Taint mode for tracking data flow from sources to sinks within a function (cross-function and cross-file tracking available with Semgrep Pro)
Supports 35+ languages
Lightweight, fast execution with no build step required

Limitations

Analyzes one file at a time by default — cross-file analysis available with Semgrep Pro
Not applicable to runtime or infrastructure state checks — check out Goss for runtime validation, or Checkov for IaC static analysis

If you’ve got a paid Semgrep subscription and are looking for multi-file support, please let us know at zenable.io/feedback.

Install

The Zenable CLI runs these verifier rules on your machine with OpenGrep or Semgrep, whichever it finds on your PATH (OpenGrep first). Zenable does not ship either tool. We recommend OpenGrep, whose LGPL-2.1 license suits most organizations; follow its install instructions. Semgrep also works: see its quickstart. To run a binary that is not on your PATH, set its location in ~/.zenable/zenable.yaml:

verifier_rules:
  engines:
    semgrep:
      path: /path/to/opengrep

Run zenable doctor to confirm which binary and version Zenable found. If your organization turns on Ask coding agents to install verifier engines when they’re missing in a config profile, the agent hook asks your coding agent to install or repair a missing engine itself.

Generated Format

Language: YAML
Structure: Semgrep rule files with id, message, severity, languages, and pattern specification fields
Execution: semgrep --config rule.yaml

Example Verifier Rule

rules:
  - id: sql-injection-prevention
    mode: taint
    languages: [python]
    severity: HIGH
    message: User input flows to SQL query without sanitization
    pattern-sources:
      - pattern: request.args.get(...)
    pattern-sinks:
      - patterns:
          - pattern: cursor.execute($QUERY, ...)
          - focus-metavariable: $QUERY
    pattern-sanitizers:
      - pattern: sanitize(...)

Learn more at Semgrep rule syntax, pattern syntax, and supported languages.

Custom verifier rules

You can author your own semgrep / opengrep rules and have Zenable apply them alongside marketplace verifier rules. Configure each custom verifier rule directory under the engine it belongs to:

verifier_rules:
  engines:
    semgrep:
      extras:
        custom_verifier_rule_dirs:
          - path: ~/.zenable/custom_verifier_rules/semgrep
            recurse: true
    opengrep:
      extras:
        custom_verifier_rule_dirs:
          - path: ~/.zenable/custom_verifier_rules/opengrep
            recurse: true

`metadata.category`

Every custom rule must declare a metadata.category from the upstream semgrep set: best-practice, correctness, maintainability, performance, portability, or security. Zenable translates these to its own FindingCategory taxonomy at the boundary. Rules with metadata.category: security must also declare confidence, likelihood, impact, subcategory, cwe, owasp, references, technology, and vulnerability_class per the upstream contributor requirements. You can use the zenable verifier-rule validate command in order to confirm your custom rule is valid for Zenable verifier rule use, for instance:

zenable verifier-rule validate opengrep ~/.zenable/custom_verifier_rules/semgrep/custom-no-eval.yaml

Overview

Integrations

MCP Server

Verifier Engines

IDE Installation Guides

Deprecated IDEs

Tools & Reference

Use Cases

Overview

Capabilities

Limitations

Install

Generated Format

Example Verifier Rule

Custom verifier rules

`metadata.category`

​Overview

​Capabilities

​Limitations

​Install

​Generated Format

​Example Verifier Rule

​Custom verifier rules

​metadata.category

Overview

Capabilities

Limitations

Install

Generated Format

Example Verifier Rule

Custom verifier rules

`metadata.category`