Summary

• Add Semgrep as a pre-commit hook to help catch security issues and common bug patterns early.
• Use Semgrep’s default ruleset (p/default) for broad multi-language coverage.
• Configure Semgrep to:
  • Fail the commit when findings are present (--error).
  • Skip unknown file extensions to reduce noise.

Only the pre-commit configuration is updated; no application code changes are included.

How to test

Testing depends on your environment:

• Devcontainer: pre-commit hooks (including Semgrep) are installed automatically.
• CI: Semgrep runs as part of the existing pre-commit lint stage.

To manually verify Semgrep runs:

pre-commit run semgrep --all-files

This should report findings if any tracked files violate rules.

Optional spot check

Create a temporary file, for example tmp_bad.py, that contains a few intentionally unsafe patterns such as:

import subprocess
import hashlib

user_input = input("Enter something: ")
eval(user_input)

subprocess.Popen(user_input, shell=True)

hashlib.md5(b"password").hexdigest()

Then add and commit the file; the Semgrep pre-commit hook should run automatically and report findings.
Remove the file afterwards.

Notes

• Semgrep’s registry-based rules send pseudonymous metrics by default; this can be disabled later if required.
• Like other static analysis tools, Semgrep may occasionally produce false positives (flagging safe code) or false negatives (missing issues), but it seems to provide meaningful early detection with minimal configuration.
• False positives can be suppressed using # nosemgrep (and other inline ignore directives) as described in the Semgrep docs: https://semgrep.dev/docs/ignoring-files-folders-code/
• For detailed documentation of Semgrep, see: https://semgrep.dev/docs/

Reviewer checks

• Semgrep runs as a pre-commit hook
• CI passes with Semgrep enabled
• No unintended changes beyond .pre-commit-config.yaml