Notifications
Clear all
Topic starter
05/08/2026 1:10 pm
Just got my first real Semgrep pipeline working. Set it up to scan our Node/TypeScript service and fail the build if any new high-severity findings are introduced.
It feels like a safety net. Before, we'd run scans but the findings just piled up in a dashboard. Now, the gate is closed. A dev can't accidentally merge a new SQL injection or path traversal. I'm still new to this, so I'm curious: is this the standard way most teams use it? Do you run it on PRs or just on the main branch after merge? Any gotchas I should watch out for with this approach?