{"id":20261347,"url":"https://github.com/parsiya/semgrep-hotspots","last_synced_at":"2026-05-28T13:31:53.781Z","repository":{"id":118394317,"uuid":"539174477","full_name":"parsiya/semgrep-hotspots","owner":"parsiya","description":"Repository for my Semgrep hot spot rules","archived":false,"fork":false,"pushed_at":"2022-12-24T01:18:42.000Z","size":22,"stargazers_count":3,"open_issues_count":2,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-03-03T18:49:24.997Z","etag":null,"topics":["semgrep","semgrep-rules","static-analysis"],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/parsiya.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-20T20:13:09.000Z","updated_at":"2024-05-19T22:34:27.000Z","dependencies_parsed_at":null,"dependency_job_id":"ee911565-e1e8-4775-bdef-a71ef16d65cb","html_url":"https://github.com/parsiya/semgrep-hotspots","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/parsiya/semgrep-hotspots","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parsiya%2Fsemgrep-hotspots","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parsiya%2Fsemgrep-hotspots/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parsiya%2Fsemgrep-hotspots/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parsiya%2Fsemgrep-hotspots/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/parsiya","download_url":"https://codeload.github.com/parsiya/semgrep-hotspots/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/parsiya%2Fsemgrep-hotspots/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33611248,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-05-28T02:00:06.440Z","response_time":99,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["semgrep","semgrep-rules","static-analysis"],"created_at":"2024-11-14T11:25:21.582Z","updated_at":"2026-05-28T13:31:53.763Z","avatar_url":"https://github.com/parsiya.png","language":"C++","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Semgrep Hot Spot Rules - Work in Progress\nRepository for my Semgrep hot spot rules.\n\n## What's a Hot Spot?\nIn this context, hot spots are parts of code that *might* contain security\nvulnerabilities. You are not \"always\" looking for a specific problem, but rather\nbad practices, common mistakes, insecure configurations, and in short, places\nwhere bad things usually happen.\n\nFor more details and examples, please read the blog post at\nhttps://parsiya.net/blog/semgrep-hotspot/.\n\n## The Audience\nThe audience for these rules are security engineers who want to find focus areas\nfor code review. These rules are noisy and are not suitable for developer facing\nviews and systems.\n\n## Quick Start\n\n1. Clone the repository.\n2. Run Semgrep with `--config` pointing to the repository or any of the\n   subdirectories.\n\n`$ semgrep --config /path/to/semgrep-hotspots/ . --sarif --output my-results.sarif`\n\n## Rules\nA list of rules and their triage guides. If you have any questions or have\nsuggestions please make an issue.\n\nTODO: Add rules and their guides here.\n\nRule ID | Language | Triage Guide\n--- | --- | ---\n[Arrays passed to functions](cpp/arrays-passed-to-functions.yaml) | C++ | [Triage Guide](cpp/arrays-passed-to-functions.md)\n[Encode/Decode in function name](cpp/encode-decode-function-name.yaml) | C/C++ | [Triage Guide](cpp/encode-decode-function-name.md)\n[Encrypt/Decrypt in function name](cpp/encrypt-decrypt-function-name.yaml) | C/C++ | [Triage Guide](cpp/encrypt-decrypt-function-name.md)\n[memcpy usage](cpp/memcpy-insecure-use.yaml) | C/C++ | [Triage Guide](cpp/memcpy-insecure-use.md)\n[Out of Bounds Array Access](cpp/arrays-out-of-bounds-access.yaml) | C/C++ | [Triage Guide](cpp/arrays-out-of-bounds-access.md)\n[Potentially Uninitialized Pointer](cpp/potentially-uninitialized-pointer.yaml) | C/C++ | [Triage Guide](cpp/potentially-uninitialized-pointer.md)\n[snprintf usage](cpp/snprintf-insecure-use.yaml) | C/C++ | [Triage Guide](cpp/snprintf-insecure-use.md)\n\n\n## Contribution\nPlease follow the [Contributing through GitHub][con-gh] section of\n`Contributing to Semgrep rules` article and make a pull request with your rules.\nPlease note the [LICENSE](LICENSE).\n\nAt a minimum, add a rule with a good Semgrep message, tests (which can double as\nexample code) and a short triage guide. The triage guide should explain why the\nrule is a hot spot and how a fellow security engineer can triage the results.\n\nIf in doubt, please use the current rules as reference or make an issue (or\ncontact me via another way). Make sure to update the guide table in the readme.\n\nTODO: Add info about the directory structure. \n\nTODO: Add info about severity level.`WARNING` seems like a good choice. Ask the r2c team for their opinion.\n\n[con-gh]: https://semgrep.dev/docs/contributing/contributing-to-semgrep-rules-repository/#contributing-through-github\n\n## LICENSE\nAttribution-NonCommercial-ShareAlike 4.0 International. Please see\n[LICENSE](LICENSE) for details. I chose this license based on the\n[Trail of Bits public Semgrep rules repository][tob-rules].\n\n[tob-rules]: https://github.com/trailofbits/semgrep-rules","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fparsiya%2Fsemgrep-hotspots","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fparsiya%2Fsemgrep-hotspots","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fparsiya%2Fsemgrep-hotspots/lists"}