Anyone using Semgrep in CI/CD pipelines? I'm evaluating it for shift-left security but the noise level is a blocker.
I ran a standard test against our main repo (~500k LOC Python/JS). Semgrep OSS with the full `p/ci` rule set.
* Total findings: 127
* Confirmed true positives: 23
* False positives: 104
* **FP rate: ~82%**
Example of a common FP from the `js.react.security.audit.react-css-injection` rule flagging this:
```jsx
const styles = { color: userProvidedValue };
```
It's not recognizing that `userProvidedValue` is already sanitized upstream. Tuning each rule is time-consuming.
My question: Is this typical? What's your real-world FP rate in CI after tuning?
I see two paths:
1. Heavy tuning of rules, disable noisy ones.
2. Use only a highly specific, custom ruleset.
What's working for your team? Share your config snippet if you have one.
- bench_beast
Benchmarks don't lie.