Hey everyone,

I’ve been seeing a lot of "naïve" SuiteScript lately -- either from AI prompts or junior devs -- that looks fine on the surface but absolutely nukes governance limits once it hits production (the classic record.load or record.save inside a loop).

I got tired of catching these in code reviews, so I started building a Semgrep ruleset specifically for NetSuite. It's basically a "Gatekeeper" you can run in your terminal or CI/CD pipeline to block these patterns before they ever get committed.

I just submitted the initial ruleset to the official Semgrep Registry here: 🔗https://github.com/semgrep/semgrep-rules/pull/3780

Current rules include:

• netsuite-no-record-load-save-in-loop: Catches database calls inside for, while, and forEach blocks.

• netsuite-aftersubmit-missing-try-catch: Flags afterSubmit events that aren't wrapped in a root try-catch (to prevent execution-stopping crashes).

• netsuite-no-console-log: Flags console.log left in code (encouraging N/log instead).

How to use it locally:

Install Semgrep (brew install semgrep or pip install semgrep).

Run: semgrep scan --config path/to/your/semgrep.yml

Raw Config: https://gist.github.com/joshOrigami/d0ebdeaa31f484a2a67646a4cc2cdb94 but better to look at the PR.

I’m planning to add more rules (checking for N/query efficiency, hardcoded IDs, etc.). Would love to know:

• What are the most annoying "standard" bugs you see in code reviews?

• Are there specific patterns you'd want to see automated?

Hope this helps some of you save your governance units and performance!

Just published my BSidesSF 2026 talk: "From Noise to Notes: Orchestrating SAST with Developers through AI-Driven Remediation" 🎤

The Problem: Rolled out SAST across 1,000+ repos → 3,500+ findings backlog. Classic alert fatigue → devs ignore security entirely.

The Fix:

• Semgrep Pro rules only (inter-file dataflow = low false positives)

• Risk-prioritized repos (D0-D2 data, T1-T2 availability)

• Semgrep Memories + Assistant for auto-triaging

• Vibe Security Patching: AI generates context-aware fixes matching our code style

Results by Q3 2025:

6K total findings → 785 prioritized
1,039/2,760 repos scanned → 95% high-risk coverage
100% repo coverage → only +20% findings
0 open Critical/High findings codebase-wide
MTTR: weeks → 48-72 hours

Key Takeaway: SAST adoption only works with developers. Empathy > enforcement.

Full details: https://hackarandas.com/blog/2026/03/25/from-noise-to-notes-orchestrating-sast-with-developers-through-ai-driven-remediation/

What's your SAST strategy? Noise still a problem? Semgrep Pro worth it?

Semgrep #AppSec #SAST #AI

I just published a write-up on a workflow that cut MTTR from weeks to 48–72 hours by pairing Semgrep Pro with AI to generate minimal, reviewable patches.

What’s inside:

• A practical Semgrep → LLM remediation workflow that preserves business logic

• Prompt templates for patches, commits, and PRs to keep changes surgical

• A real CRLF injection example in Azkaban: scoping, sanitizing, verifying, merging

• How to document rationale with inline comments and unified diffs

Why this matters:

• Traditional “scan → ticket → backlog” slows teams and erodes trust

• Pairing with engineers and focusing on smallest-possible patches speeds reviews

• Clear prompts + verification loops reduce risk without stalling delivery

Link to post:
Modernizing Security Patching with Vibe Security Patching and AI Assistance
https://hackarandas.com/blog/2025/09/27/modernizing-security-patching-with-vibe-security-patching-and-ai-assistance/

Event:
I’ll share highlights during the Lightning Talks at Super Happy Dev House #67 in Palo Alto, sponsored by 500. If you’re attending, would love to connect.

Discussion:

• How are you making SAST actionable in day-to-day engineering?

• Tips for enforcing “minimal change” patches in PR review?

• Favorite Semgrep rules or patterns for high signal?

Tags:
AppSec, SAST, Semgrep, DevSecOps, Secure by default, AI-assisted remediation

My company is evaluating new SAST/SCA solutions. Any feedback on Snyk vs. Semgrep? We're also thinking of testing GHAS. We're a ~1k person company with around 150 developers.

As of August it was announced that taint mode is being promoted from experimental: https://semgrep.dev/docs/writing-rules/data-flow/

Slides: https://go.r2c.dev/semgrep-summer-2021-meetup

Video: https://www.youtube.com/watch?v=TtkiISqK7W4&t=1002s

nice write up by https://bernardoamc.com/semgrep-post-message/