Semgrep Guardian goes self-serve with Codex support, plus incident-first advisories and transitive Autofix. See everything ...

One Brotli decoder bug. A lot of copies. TL;DR - CVE-2026-111497 is an out-of-bounds write in the Brotli decompressor in google/brotli, fixed upstream in 1.2.1. It is not a separate Node, PHP, or npm ...

Semgrep is sponsoring our friends at OWASP Netherlands Chapter's next meetup – taking place on 29th October at KvK HQ, Utrecht. We're looking forward to catching up with the Dutch AppSec community!

Forrester has named Semgrep a Strong Performer in the first edition of The Forrester Wave™: Agentic Development Security ...

TL;DR: We continue our previous research in evaluating Claude Code and OpenAI Codex on finding vulnerabilities in real, open-source applications, with simple prompts and no scaffolding. In this post ...

AI agents are writing code now. That part is settled. The question security teams should be asking is: how do you make those agents write secure code from the start, rather than trying to catch ...

Visit us in booth #D3 for custom live demos and to learn how Semgrep’s low-noise results and AI guidance across SAST, SCA, and Secrets can help you fix vulnerabilities early, speed up releases, and ...

It is with a complicated mixture of grief, relief, and the quiet satisfaction of an "I told you so" held in for over a decade that we record the passing of automatic lifecycle script execution in npm, ...

We're hosting a few of our customers, including Blackstone's security team, in Semgrep's private suite for Nets vs. Bulls at Barclays Center. We'd love for you to join us.

Set your status to OOO. Between trainings and the main conference, patch out the stress with massages, chill vibes, bites and drinks. This is our night to recognize the people who contribute to making ...