yaml 15 lines · 1 tab

Static application security testing with Semgrep in CI

Kai Nakamura Apr 2026

1 tab

name: semgrep

on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: returntocorp/semgrep-action@v1
        with:
          config: >-
            p/owasp-top-ten
            p/ruby
            p/javascript

1 file · yaml Explain with highlit

SAST is most useful when rules are actionable and fit the stack. I use Semgrep to catch dangerous patterns like command injection, weak crypto, SSRF sinks, and raw SQL interpolation. The signal stays high when teams tune rules and suppressions deliberately instead of adopting everything at once.

Related snips

javascript

const withBundleAnalyzer = require('@next/bundle-analyzer')({
  enabled: process.env.ANALYZE === 'true',
  openAnalyzer: true,
});

/** @type {import('next').NextConfig} */

Next.js bundle analyzer for targeted performance work

nextjs performance tooling

by codesnips 4 tabs

ruby

class ExplainAnalyzer
  def initialize(relation, watched_tables:)
    @relation = relation
    @watched_tables = Array(watched_tables).map(&:to_s)
  end

Fast Fail for Missing Indexes (EXPLAIN sanity check)

rails postgres performance

by codesnips 3 tabs

yaml

- name: Build image
  run: docker build -t app:${{ github.sha }} .

- name: Scan image
  uses: aquasecurity/trivy-action@0.24.0
  with:

Trivy image scanning in pull request pipelines

trivy containers ci

by Kai Nakamura 1 tab

typescript

import { defineConfig, devices } from '@playwright/test';
import path from 'node:path';

export const authFile = path.join(__dirname, '.auth/user.json');

export default defineConfig({

Playwright smoke test for auth flow

testing playwright e2e

by codesnips 4 tabs

yaml

name: CI

on:
  push:
    branches: [main]
  pull_request:

GitHub Actions: cache + tests + build

ci github-actions node

by codesnips 3 tabs

bash

#!/usr/bin/env bash
docker run --rm -t owasp/zap2docker-stable zap-baseline.py \
  -t https://preview.example.com \
  -r zap-report.html \
  -I

Web application DAST automation with OWASP ZAP baseline scans

dast zap ci

by Kai Nakamura 1 tab

Share this code

Here's the card — post it anywhere.

Static application security testing with Semgrep in CI — share card

Link copied