# Did Semgrep Just Get A Lot More Interesting?

DevFeed: [Did Semgrep Just Get A Lot More Interesting?](<https://devfeed.tech/articles/did-semgrep-just-get-a-lot-more-interesting-1716.md>)

Original publisher: [Read original article](<https://fly.io/blog/semgrep-but-for-real-now/>)

Published: 2025-02-10T00:00:00Z

Content type: opinion

Language: en

Sources: [The Fly Blog](<https://devfeed.tech/sources/the-fly-blog.md>)

Topics: [AI-assisted coding](<https://devfeed.tech/topics/ai-assisted-coding.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>), [cursor](<https://devfeed.tech/topics/cursor.md>)

Tags: [cdn](<https://devfeed.tech/tags/cdn.md>), [close-to-users](<https://devfeed.tech/tags/close-to-users.md>), [code-generation](<https://devfeed.tech/tags/code-generation.md>), [cursor](<https://devfeed.tech/tags/cursor.md>), [deploy-app-servers](<https://devfeed.tech/tags/deploy-app-servers.md>), [docker](<https://devfeed.tech/tags/docker.md>), [elixir](<https://devfeed.tech/tags/elixir.md>), [fly](<https://devfeed.tech/tags/fly.md>), [fly-io](<https://devfeed.tech/tags/fly-io.md>), [heroku-alternative](<https://devfeed.tech/tags/heroku-alternative.md>), [heroku-competitor](<https://devfeed.tech/tags/heroku-competitor.md>), [hosting](<https://devfeed.tech/tags/hosting.md>), [i](<https://devfeed.tech/tags/i.md>), [networking](<https://devfeed.tech/tags/networking.md>), [postgresql-clusters](<https://devfeed.tech/tags/postgresql-clusters.md>), [security](<https://devfeed.tech/tags/security.md>), [servers](<https://devfeed.tech/tags/servers.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

An opinion piece argues that LLM coding agents can be guided with self-authored rules and may help generate Semgrep rules for security vulnerability searches.

## Source excerpt

This whole paragraph is just one long sentence. God I love just random-ass blogging again. This bit by Geoffrey Huntley is super interesting to me and, despite calling out that LLM-driven development agents like Cursor have something like a 40% success rate at actually building anything that passes acceptance criteria, makes me think that more of the future of our field belongs to people who figure out how to use this weird bags of model weights than any of us are comfortable with. I've been dinking around with Cursor for a week now (if you haven't, I think it's something close to malpractice not to at least take it -- or something like it -- for a spin) and am just now from this post learning that Cursor has this rules feature. The important thing for me is not how Cursor rules work, but rather how Huntley uses them. He turns them back on themselves, writing rules to tell Cursor how to organize the rules, and then teach Cursor how to write (under human supervision) its own rules. Cursor kept trying to get Huntley to use Bazel as a build system. So he had cursor write a rule for itself: "no bazel". And there was no more Bazel. If I'd known I could do this, I probably wouldn't have bounced from the Elixir project I had Cursor doing, where trying to get it to write simple unit tests got it all tangled up trying to make Mox work. But I'm burying the lead. Security people have been for several years now somewhat in love with a tool called Semgrep. Semgrep is a semantics-aware code search tool; using symbolic variable placeholders and otherwise ordinary code, you can write rules to match pretty much arbitary expressions and control flow. If you're an appsec person, where you obviously go with this is: you build a library of Semgrep searches for well-known vulnerability patterns (or, if you're like us at Fly.io, you work out how to get Semgrep to catch the Rust concurrency footgun of RWLocks inside if-lets). The reality for most teams though is "ain't nobody got time for th