code pattern matching / static analysis tool
For un instrument de analiză statică pentru securitatea codului, the strongest matches are millionco/react-doctor (React Doctor is a static analysis tool focused on), pmd/pmd (PMD is a multi-language static analyzer with a CLI) and semgrep/semgrep (Semgrep itself: an open-source static analysis security testing tool). eslint/eslint and crytic/slither round out the shortlist. Each is ranked by relevance to your query, popularity and recent activity.
Selectăm repository-uri open-source de pe GitHub care se potrivesc cu „semgrep semgrep”. Rezultatele sunt clasificate după relevanța față de căutarea ta — folosește filtrele de mai jos pentru a rafina rezultatele sau utilizează AI-ul.
Rezultate pentru „un instrument de analiză statică pentru securitatea codului”
Găsește cele mai bune repo-uri cu AI.Vom căuta cele mai potrivite repository-uri folosind AI.
- millionco/react-doctor
millionco/react-doctor
12,769Vezi pe GitHubReact Doctor is a static analysis tool for React codebases designed to identify security, performance, and architectural issues. It functions as a codebase health diagnostic engine that produces numeric health scores and structured diagnostics to improve maintainability. The tool features an incremental code scanner that evaluates only the files changed between branches or staged in the working tree to provide fast feedback. It is designed to operate as a quality gate within CI pipelines, allowing for the enforcement of codebase health standards by failing builds on critical errors. The anal
React Doctor is a static analysis tool focused on React codebases, offering CI integration and AST pattern matching, but it lacks the multi-language support and general-purpose rule writing that defines Semgrep, so it is a narrower match for this search.
TypeScriptAST Pattern MatchingCI/CD Pipeline Integrations - pmd/pmd
pmd/pmd
5,425Vezi pe GitHubPMD is a multi-language static code analyzer used to identify programming flaws, unused variables, and dead code without executing the program. It functions as a code smell detector and coding standard enforcer, ensuring source code adheres to specific naming conventions, structural requirements, and project style guides. The project features an XPath-based rule engine that allows users to define custom analysis patterns using queries against an abstract syntax tree. It also includes a copy-paste detector to identify duplicated code blocks across multiple files and a visual rule designer for
PMD is a multi-language static analyzer with a CLI, custom XPath-based rules, and CI integration, making it a related pattern-matching tool to Semgrep, though it uses AST queries rather than Semgrep's surface-pattern syntax.
JavaCustom Analysis Rules - semgrep/semgrep
semgrep/semgrep
15,603Vezi pe GitHubSemgrep is a static analysis security testing tool designed to identify vulnerabilities and logic errors by matching source code against declarative patterns. It functions as an automated scanner that integrates into development workflows to detect insecure code patterns and enforce coding standards before deployment. The engine utilizes a language-agnostic intermediate representation and a modular parser architecture to normalize diverse programming languages into a unified format. This allows for consistent rule execution across different codebases, enabling users to perform custom structur
Semgrep itself: an open-source static analysis security testing tool that matches source code against declarative patterns, supports many languages, custom rules, CLI, and CI integration — exactly the tool you're looking for.
OCamlStatic Code Analysis ToolsSecurity Code ScannersSecurity Testing - eslint/eslint
eslint/eslint
27,349Vezi pe GitHubThis project is a static analysis engine designed to identify patterns, enforce coding standards, and automate code quality improvements in software projects. By parsing source code into structured abstract syntax trees, it enables deep programmatic inspection and the automated remediation of identified programming issues. The engine functions as a pluggable linting framework, allowing developers to extend its core capabilities through a modular architecture. Users can inject custom rules, parsers, and processors to support non-standard file formats or domain-specific logic. This extensibilit
ESLint is a pluggable linting framework for static code analysis and pattern matching, but it primarily targets JavaScript/TypeScript, making it a related but narrower tool than the multi-language Semgrep you are looking for.
JavaScriptCustom Analysis Rules - crytic/slither
crytic/slither
6,141Vezi pe GitHubSlither is a static analysis tool for Solidity and Vyper smart contracts, which fits the pattern-matching static analysis category but is limited to Ethereum-specific languages, whereas the visitor likely wants a general-purpose tool like Semgrep.
PythonCustom Analysis RulesCI/CD Pipeline Integrations - pycqa/bandit
PyCQA/bandit
8,092Vezi pe GitHubBandit is a static analysis security testing tool and vulnerability detection scanner for Python source code. It functions as a security-focused linter and static analyzer that identifies common vulnerabilities and architectural flaws without executing the program. The tool utilizes an abstract syntax tree to analyze code patterns and identifies risky function calls or insecure configurations. It employs a plugin-based rule engine to decouple scanning logic from individual security checks and supports configuration-driven filtering to exclude specific files or ignore certain warnings. The sy
Bandit is a static analysis security tool for Python code that uses AST-based pattern matching and supports custom rules, fitting the type of tool the visitor is after, though it is Python-specific rather than multi-language.
PythonSource Code Vulnerability ScanningAST Security AnalyzersRule-Based Plugin Systems
