Semgrep

Static analysis (SAST) · Any stack · stage: sast

Static analysis on every agent worktree, with a native path to compliance evidence.

Agents write plausible code, and plausible code is where injection bugs live: a shell=True here, string-built SQL there. The Semgrep plugin adds a sast stage that scans the session worktree with Semgrep’s rulesets, so insecure patterns block the agent before merge instead of surfacing in review — or production.

Findings fail the stage with the exact rule and location in the report, which is precisely the feedback loop agents fix fastest.

What it installs

A sast test stage registered in .har/stages.json and added to verificationStages.
An adaptation guide at .har/stages/SEMGREP.md covering rulesets and noise tuning.
A GitHub Actions workflow running the official semgrep ci recipe (skip with --skip-ci).

Requirements

The semgrep CLI (pipx install semgrep) — the stage fails fast with an install hint when missing
Registry rulesets (the default auto) need network access; offline repos can pin local rules

Artifacts & evidence

JSON and SARIF reports land under .har/artifacts/sast/, alongside the scan log.

Adapting it to your repo

Pin rulesets with HARNESS_SEMGREP_CONFIG in .har/harness.env (default auto).
Tune noise with .semgrepignore and nosemgrep annotations — guidance ships in .har/stages/SEMGREP.md.

CI & compliance

This plugin has the strongest compliance story of the security set. The local stage is the shift-left layer — findings block agents before merge, invisible to compliance platforms by design. For evidence, set the SEMGREP_APP_TOKEN secret so the CI workflow publishes to the Semgrep AppSec Platform, which Vanta reads through its native Semgrep integration.

Semgrep Vanta × Semgrep integration Plugin install guide