01 / THE WORK
What we admire
Semgrep’s rules demonstrate the power of describing a problem in a form close to the source being checked. That makes static findings easier to understand and audit.
02 / THE LESSON
The principle that stayed
Static analysis is strongest with a selected rule pack and known scope. A generic scanner cannot turn every warning into a reproduced failure, and running more rules is not automatically better.
03 / OUR BOUNDARY
Where CodeVetter stands
Our OSS decision parked Semgrep until specific rule packs justify its cost and packaging. CodeVetter’s current verification loop does not depend on Semgrep.