Introduction and course overview
Vulnerabilities are still everywhere
Traditional SAST tools still use a reactive approach
With secure guardrails we can be more proactive
We can borrow ideas from the DevOps movement
Secure defaults, shift left, and secure guardrails
Secure guardrail examples
Why customize rules
Semgrep analysis architecture
Semgrep Playground
Writing test code
Structure mode
The first rule: marking a banned function
Enforce the order of API calls
Blocklist DES and TripleDES
Sec Fetch Metadata headers
Problem domain and search language
Semgrep under the hood: matches, ranges, and set logic
Debugging negative patterns
pattern-not versus pattern-not-inside
