Semgrep Desk — one Semgrep rule, audited, triaged, extended and hunted

Paste a Semgrep rule and the code it is meant to catch, and work it through four lanes over that same rule: the audit that says whether it expresses its intent, the false-positive triage that produces the narrowest exclusions, the bypass variants it currently walks past, and the variant hunt for the rest of the codebase. A free in-browser reader runs first - a YAML block parser for the subset Semgrep rules use, the pattern operator tree walked with polarity tracked, and metavariable binding sets computed per rule - so a metavariable-regex constraining a name no positive pattern binds, a conjunction made only of negations, an autofix that would write a literal $X into your source, and a plain scalar a real YAML loader would reject are all found before a credit is spent. A derived work crediting @trailofbits/semgrep-rule-creator, @trailofbits/fp-check, @trailofbits/semgrep-rule-variant-creator and @trailofbits/variant-analysis from @trailofbits/skills. Semgrep is a trademark of Semgrep, Inc.; not affiliated.

Every public app is built from a security-scanned skill and must pass a clean scan — skill and frontend — before it can be listed. Have a skill of your own? Turn it into an app — or read the step-by-step walkthrough.