My Semgrep C/C++ ruleset is ready for prime time again July 15, 2026 | By Marco Ivaldi Articles , Tools “Retention of critical thinking and problem solving skills in an AI saturated world will probably become a superpower for those who can resist the autocomplete revolution.” — Bas Alberts “I spend a truly unreasonable amount of my life writing YAML.” — William Woodruff TL;DR For those with an attention span shorter than a goldfish , a quick summary of what’s going on here: Back in 2022, I published a collection of Semgrep rules that I developed to facilitate C/C++ vulnerability research . I also wrote a couple of accompanying blog posts to introduce my ruleset and show how to use it to automate binary vulnerability discovery . Over the years, my project has gained popularity and has been featured in prominent guides and toolkits . Meanwhile, I kept improving my ruleset and applying it to real-world vulnerability research scenarios . Today, it’s once again time to shed light on some recent updates and improvements , before our new robot overlords take over the field of vulnerability research entirely. So, bear with me while I introduce you to my newly-improved Semgrep C/C++ ruleset . A blast from the past First, a quick review of my previous work. As stated in the summary above, in 2022 I released my custom Semgrep rules for C/C++ vulnerability research and published a well-received article on how to become a better security researcher , using the power of Semgrep to automate some menial tasks even against binary targets. At the end of 2023, I published a big update to my ruleset. It featured several new rules, a reorganization into three priority tiers, and general accuracy and performance tweaks. These improvements were driven by the experience gained in the field during my vulnerability research efforts and by attending training courses on this subject (namely, OST2 ‘s Vulns1001 and Vulns1002, and InfoSect ‘s Code Review). Finally, I extensively tested my rules against available SAST test suites and test cases, conveniently collected by NIST’s Software Assurance Metrics And Tool Evaluation ( SAMATE ) project. Again, these updates sparked quite a bit of interest in the security community, which led me to implement similar functionality in the form of weggli patterns . Besides presenting my toolkit, in my blog posts I also focused on providing an actionable vulnerability research workflow that can be summarized as follows: Read the documentation (but don’t believe it! ) to uncover attack surface and interesting paths. Scan with static analysis tools against interesting paths in the codebase. Review scan results to quickly mark hotspots in code where bugs may be. Understand relevant code around the hotspots to identify potential vulnerabilities . Confirm vulnerabilities via further analysis , dynamic testing, targeted fuzzing, etc. Identify variants of confirmed vulnerabilities in other parts of the codebase. Revisiting this workflow in 2026, you’ll probably want to weave AI into each step as a force multiplier. Don’t worry though, fuzzer jobs are (probably) safe for now. Frankly, I'm appalled by the prospect of LLMs taking offensive security research jobs from honest, hard-working fuzzers — lcamtuf (@lcamtuf) June 22, 2024 For further considerations on methodology applied to real-world scenarios , check out my past articles . Here we go again When I created my ruleset, Semgrep’s support for C/C++ was still experimental. It wasn’t until 2024 that Semgrep started to fully support C and C++ , languages that are notoriously difficult to analyze statically , due to several inherent complexities (most notably, an ambiguous and hard-to-parse grammar chiefly because of preprocessor directives and macros that are expanded before compilation). As a result of this fundamental improvement, scanning of C/C++ code with Semgrep became more stable and reliable, new patterns were made possible, and handling of C/C++-related GitHub issues became smoother. Fast forward to late 2025. Hey developers and vulnerability researchers! I'm working on improving my C/C++ #Semgrep ruleset, and I've just published the v1.1.0 release: https://t.co/UQpsnQ8Grv Please test it inside and out, open issues or submit PRs. Aiming for a major release sometime before spring. — raptor (@0xdea) December 3, 2025 With the above message, cross-posted to my social media accounts, I announced the availability of the v1.1.0 release of my ruleset, which included: New rules for detecting high-entropy assignments and ReDoS vulnerabilities . Several enhancements to existing rules. Reduced false positives without sacrificing coverage. Optimized and more performant patterns. Overall better documentation, including a SARIF sample. I also issued a call to action to software developers and security researchers to test the new version of the rules, open issues, and submit pull requests with bug fixes and enhancements. Some researchers responded, and also thanks to ...