At r2c, we've been using our own https://semgrep.dev/ https://semgrep.dev/ to search across our repositories and take inventory of certain things. For instance,

At r2c, we've been using our own https://semgrep.dev/ https://semgrep.dev/ to search across our repositories and take inventory of certain things. For instance, we have a Semgrep rule that finds and extracts API routes and whether they require authentication. See page 27 for a visualization (PDF warning): https://owasp.org/www-chapter-dorset/assets/presentations/2020-10/OWASP%20Dorset%202020-10-08.pdf https://owasp.org/www-chapter-dorset/assets/presentations/20...