semgrep
Local SAST. Point it at reconstructed source maps or a dumped .git and hunt sinks (innerHTML, exec, pickle, yaml.load) with public rulesets.
Tags: sast, rules, sinks
- Category
- js
- Maintenance signal
- active
Use this when: JavaScript. Read a bundle you already saved. A pattern match is not execution.
Install
pipx
pipx install semgrepCommand templates
JS sinks
semgrep --config=p/javascript {path}