Using Semgrep with Jupyter Notebook files
research.nccgroup.com
If you frequently deliver source code review assessments of products, including machine learning components, I’m sure you are used to reviewing Jupyter Notebook files (usually python). Althou…

Now here’s two tools I wish I was more experienced with - Semgrep and Jupyter. Beyond this cool article from NCC, I’m interested to hear from anyone who uses either one of these tools. How did you get started, what do you do with them, etc…

  • @himazawa@infosec.pubEnglish
    0•2 years ago

    I used semgrep in the past, my team is still evaluating which tool for SAST to use as a standard internally but we are mostly oriented on CodeQL

    • shellsharksOPMEnglish
      0•2 years ago

      What do you like about CodeQL? Haven’t used that yet either.

      • @himazawa@infosec.pubEnglish
        1•2 years ago

        Report quality (less FP) compared to semgrep, snyk and sonarcloud but a killer feature for me is that you get the call paths so you can see when and how a vulnerable dependency is called. Pretty useful on big codebases.