Semgrep App
https://semgrep.dev/products/semgrep-app Hi! I work on Semgrep, an open-source project (discussed on HN previously [0][1)]. We’re one of those companies that maintain an OSS tool and a web app, and then monetize by selling enterprise features on said web app. Our free web app just went through a major revamp (sort of like a v1.0 release) so this feels like the perfect time to share and hear what the HN crowd thinks! Let me start with some backstory on Semgrep. Our team, r2c, has been experimenting with various ways to help organizations step up their application security…
What it does
In the maker’s words, at launch
https://semgrep.dev/products/semgrep-app Hi! I work on Semgrep, an open-source project (discussed on HN previously [0][1)]. We’re one of those companies that maintain an OSS tool and a web app, and then monetize by selling enterprise features on said web app. Our free web app just went through a major revamp (sort of like a v1.0 release) so this feels like the perfect time to share and hear what the HN crowd thinks! Let me start with some backstory on Semgrep. Our team, r2c, has been experimenting with various ways to help organizations step up their application security game. One of our earliest experiments was Bento, a wrapper around multiple existing linters to help people configure various tools like ESLint and Bandit in one go. The bottleneck with a tool like this was, of course, interfacing with more and more tools. I had previously worked on a similar project called coala[2] which got all the way up to 78 analyzers covering 54 languages, until the project ground to a halt over the maintenance burden of all that. One of our team members at r2c came up with a novel approach to this problem: he suggested reusing some of his old work on Coccinelle[3] and later Sgrep[4], which were tools to search parsed syntax trees of various languages. Conceptually this meant that while Bento and coala could standardize the command-line interface, the configuration syntax, and file targeting logic of linters, now we could also standardize the core linting logic. Extending Bento with linting rules using this pattern language proved to be so easy that we rather just reimplemented the existing linters with it. And thus, Semgrep was born specifically to scan code with these pattern definitions, and there was no longer a need for Bento. Our rule registry[5] now contains over 1,500 rule definitions in this standardized linter rule definition language, across 20 languages. And this leads us to our web app. Early adopters of Semgrep encountered problems rolling out the CLI tool across their organization. Their key needs: scanning hundreds of repos, reviewing all their scan results, deploying custom organization-internal rules across them, and avoiding backlash from developers during all that. We also made the unorthodox decision to start with a ground rule that we never ever want to have access to the source code of our customers. These needs and rules guided our web app’s feature set, which ended up being: provisioning CI jobs on repositories, centrally configuring which rules should block builds or notify people, sending notifications via PR comments/Slack/email, and displaying the list of all findings, along with some analytics. As for today, we just launched a major release of Semgrep App, which cuts down on the complexity that built up in our original implementation, and we also tried to expand the problem space our app tackles all the way through remediating issues on the web UI. You can read more about these recent changes at https://r2c.dev/blog/2021/semgrep-app-fall-2021-updates/ And as for the future, two main areas of interest are 1) intelligently selecting all the right Semgrep Registry rules for a given project and 2) creating a smooth workflow for organizations to collaboratively maintain their own set of internal Semgrep rules. Please check out the app we built at https://semgrep.dev/products/semgrep-app, and let us know what you think! I’ll be hanging out in the comments as one of the engineers who built the app, but our CEO (ievans) is also ready to answer questions, and the rest of the team will surely be lurking here as well. [0]: https://news.ycombinator.com/item?id=24931985 [1]: https://news.ycombinator.com/item?id=26904951 [2]: https://github.com/coala/coala/ [3]: https://en.wikipedia.org/wiki/Coccinelle_(software) [4]:…
Does the same job
all alternatives →
- IVI've open-sourced my ERP SaaS, Stockor2014 · ▲46
For the last several years I've been creating a ERP platform, Stockor. While I'm going to continue offering it as a SaaS, I've decided to also open-source it. I'm hopeful that by doing so it will: 1) Grow it into a Wordpress size juggernaut with a plugin for any business process under the sun. 2) Bring me interesting consulting gigs. The open-source site is at stockor.org. There's a demo up at stockor.com/demo as well. Looking forward to hearing HN's thoughts!
- SHShow HN2011 · tonecheck.com · ▲14
Hi, i was wondering what the HN community thinks of this email tone check application? Do you think this can be done better with open-source? Disclaimer: I am neither a founder or an employee at the company. Just someone who had a similar idea.
- HAHorcrux, a Mac app to back up or move your IMAP emails2013 · thehorcrux.com · ▲54
Hi, Creator here. I'm sort of reposting the same thing from about 208 days ago. The first version kinda sucked. I guess this is my first lean not-really-a startup experience. The new version is much better. http://thehorcrux.com/why-i-built-horcrux-app/ Let me know what you think, Here are some promo codes: 97HNR6HW4EPH K9R7KTWPTJJ6 WPM3MK4WXNHY 3P7N9RNPF4M4 3N49NP9P7TR6 Cheers, Suhas Sharma
- RTRefind – The home for the best links on the web2015 · ▲41
We’re building Refind, a community of founders, hackers, and designers who collect and share the best links on the web. It’s super early but we’re on Product Hunt today and we don’t want to miss the opportunity to reach out to HN too! Founders, hackers, and designers are the audience we had in mind when building this so we’d really love to know what you think! https://refind.com HOW IT WORKS Save great links that will come in handy in the future. Discover what others save. And then find everything again when you really need it – for example when you later search for this topic on…
- AHa HN android app (weekend project)2012 · ▲5
I've been playing around with Android development recently, and made this Hacker News app this weekend: Market link: https://market.android.com/details?id=com.mellort.hackernews ($1) Dropbox link: http://db.tt/jlqIcBg1 (free: if you like it, DL from the market, too!) I used api.ihackernews.com for the data. Unfortunately, some of the pagination from that source is broken, so I can only return one page of results. In the future, I might play around with creating my own API server on App Engine. I'm not sure what my plans are for the source yet, but I'd like to make it open source. If you're…
More dev tools this month
the category →
Open-source GTM skills for technical founders
Dev tools · 29d ago · gtmcofounder.com
OpenTrailPaper is open-source bike computer firmware for the LilyGO T5S3 4.7" E-Paper PRO. It supports offline maps, GPX routes, FIT recording and Bluetooth sensors.
Dev tools · 1d ago · opentrailpaper.com
Launched alongside, October 2021
the whole month →
AI powered Twitter growth & scheduling for makers
Growth · 2021 · tweethunter.io
CleanUp.Pictures▲755Remove objects and defects from your pictures - 100% free
AI · 2021 · cleanup.pictures
