Files
Dragan Spiridonov 253cefab7e fix: wire semgrep into SAST pipeline and correct security scanner overclaims
Semgrep integration was well-written but only used as a fallback in the
coordination layer — never invoked when the regex scanner succeeded.
Now SASTScanner.scanWithRules() runs pattern scanning + semgrep in parallel
when semgrep is installed, merging and deduplicating results.

Also corrects agent documentation that falsely claimed OWASP ZAP, TruffleHog,
Gitleaks, ESLint Security, and Snyk integrations. The actual implementations
are: regex patterns + semgrep (SAST), OSV API (deps), custom fetch-based
scanner (DAST), and regex patterns (secrets).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-13 13:46:52 +00:00
..