We've been working with the r2c folks for a while, and been using semgrep since before it was called semgrep. If you can write code in a language, you can use

We've been working with the r2c folks for a while, and been using semgrep since before it was called semgrep. If you can write code in a language, you can use semgrep. It also has a feature I have learned to love every time I find it in any kind of auditing tool: it’s ruthlessly effective as an exploratory and experimental tool, but it takes no effort at all to turn that into a persistent check. By comparison: ripgrep finds anything fast, but nobody uses it to write linters. Other off the shelf linters do a great job finding (simple) issues, but bandit doesn’t help me one bit to build a mental map of how a codebase works.