A: Yes, Semgrep Appsec platform can actually seamless integrate with private source code repos via Semgrep Network Broker.

The Semgrep Network Broker facilitates secure access between Semgrep and a private network.

The broker accomplishes this by establishing a Wireguard VPN tunnel with the Semgrep backend, and then proxying inbound (Semgrep → customer) HTTP requests through this tunnel. This approach allows Semgrep to interact with on-prem resources without having to expose them to the public internet.

https://github.com/semgrep/semgrep-network-broker

Semgrep FAQ for end users (8) was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.

A: as of today, Semgrep SSC (Semgrep Supply Chain) support reachability analysis for 11 programming languages:

• C#
• Go
• Java
• JavaScript
• TypeScript
• Kotlin
• PHP
• Python
• Ruby
• Scala
• Swift

Semgrep FAQ for end users (7) was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.

A: Yes. When applicable, Semgrep Assistant uses large language models to analyze findings in the context of your organization and codebase. It then generates enriched insights — including triage guidance, potential exploit scenarios, and recommended remediation steps. You can view any available exploit details, including payload examples, directly within the Finding Description section of each finding’s page.

Semgrep FAQ for end users (6) was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.

A: sometimes, developer might take the shortcut to suppress some Semgrep reporting by using inline pragma like nosem in the code comment; as a member of appsec team, you might want to scan through everything in the CI regardless ofnosem .

This is made possible by the following Semgrep CLI flag:

--disable-nosem

Semgrep FAQ for end users (5) was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.

A: NO, the cloud runner cost and LLM subscription cost are born by Semgrep.

Semgrep FAQ for end users (4) was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.

A: TLDR

• auto-triage
• auto-fix
• memories / user provided context

• Overview | Semgrep
• AI Assistant | AppSec Engineer Assistant to Accelerate Time to Fix

Semgrep FAQ for end users (3) was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.

A: click on the 3 dots to the right of your project/repo, and select Delete project .

Semgrep FAQ for end users (2) was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.

A: simple,

• if you are managing Semgrep findings from the web portal (semgrep.dev), then you are already using the commercial version of Semgrep.
• if you only running Semgrep from command line and without a token, then you are surely using Semgrep CE (community edition).

Semgrep FAQ for end users (1) was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.

setup Python environment in Jupyter notebook,

%pip install --upgrade --quiet  langchain langchain_community langchain_core langchain_openai pymongo lark

import os

OPENAI_API_KEY = "sk-xxxxx"
os.environ["OPENAI_API_KEY"] = OPENAI_API_KEY

add current IP address to MongoDB,

!curl ipecho.net/plain

then load the data to MongoDB,

from langchain_community.vectorstores import MongoDBAtlasVectorSearch
from langchain_core.documents import Document
from langchain_openai import OpenAIEmbeddings
from pymongo import MongoClient

CONNECTION_STRING = "mongodb+srv://rw-user-1:$pwd@clusterm0.nnnnn.mongodb.net/?tls=true&retryWrites=true&w=majority&appName=ClusterM0"
DB_NAME = "media"
COLLECTION_NAME = "movie"
INDEX_NAME = "default"

MongoClient = MongoClient(CONNECTION_STRING)
collection = MongoClient[DB_NAME][COLLECTION_NAME]

embeddings = OpenAIEmbeddings()

docs = [
    Document(
        page_content="A bunch of scientists bring back dinosaurs and mayhem breaks loose",
        metadata={"year": 1993, "rating": 7.7, "genre": "action"},
    ),
    Document(
        page_content="Leo DiCaprio gets lost in a dream within a dream within a dream within a ...",
        metadata={"year": 2010, "genre": "thriller", "rating": 8.2},
    ),
    Document(
        page_content="A bunch of normal-sized women are supremely wholesome and some men pine after them",
        metadata={"year": 2019, "rating": 8.3, "genre": "drama"},
    ),
    Document(
        page_content="Three men walk into the Zone, three men walk out of the Zone",
        metadata={"year": 1979, "rating": 9.9, "genre": "science fiction"},
    ),
    Document(
        page_content="A psychologist / detective gets lost in a series of dreams within dreams within dreams and Inception reused the idea",
        metadata={"year": 2006, "genre": "thriller", "rating": 9.0},
    ),
    Document(
        page_content="Toys come alive and have a blast doing so",
        metadata={"year": 1995, "genre": "animated", "rating": 9.3},
    ),
]

vectorstore = MongoDBAtlasVectorSearch.from_documents(
    docs,
    embeddings,
    collection=collection,
    index_name=INDEX_NAME,
)

now, we need to add in the search index to the database,

{
  "mappings": {
    "dynamic": true,
    "fields": {
      "embedding": {
        "dimensions": 1536,
        "similarity": "cosine",
        "type": "knnVector"
      },
      "genre": {
        "type": "token"
      },
      "ratings": {
        "type": "number"
      },
      "year": {
        "type": "number"
      }
    }
  }
}

now let’s run a search

def create_vector_search():
    """
    Creates a MongoDBAtlasVectorSearch object using the connection string, database, and collection names, along with the OpenAI embeddings and index configuration.

    :return: MongoDBAtlasVectorSearch object
    """
    vector_search = MongoDBAtlasVectorSearch.from_connection_string(
        CONNECTION_STRING,
        f"{DB_NAME}.{COLLECTION_NAME}",
        embeddings,
        index_name=INDEX_NAME
    )
    return vector_search

def perform_similarity_search(query, top_k=1):
    """
    This function performs a similarity search within a MongoDB Atlas collection. It leverages the capabilities of the MongoDB Atlas Search, which under the hood, may use the `$vectorSearch` operator, to find and return the top `k` documents that match the provided query semantically.

    :param query: The search query string.
    :param top_k: Number of top matches to return.
    :return: A list of the top `k` matching documents with their similarity scores.
    """

   # Get the MongoDBAtlasVectorSearch object
    vector_search = create_vector_search()

    # Execute the similarity search with the given query
    results = vector_search.similarity_search_with_score(
        query=query,
        k=top_k,
    )

    return results

# Example of calling the function directly
#relevant_documents = perform_similarity_search("What are some movies about dinosaurs")
relevant_documents = perform_similarity_search("I want to watch a movie about toys rated higher than 9")
print("Number of relevant documents:", len(relevant_documents))

for document in relevant_documents:
    print("Document content:", document)
    print()

we get some similar records as following

Number of relevant documents: 1

trying out MongoDB vector search using OpenAI was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.

— create a KIND cluster with 1 control plane and 2 worker nodes;

— and label control plane to make it ready for ingress deployment.

— open up the port 80 and 443

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: worker
- role: worker
- role: control-plane
  kubeadmConfigPatches:
  - |
    kind: InitConfiguration
    nodeRegistration:
      kubeletExtraArgs:
        node-labels: "ingress-ready=true"
        authorization-mode: "AlwaysAllow"
  extraPortMappings:
  - containerPort: 80
    hostPort: 80
    protocol: TCP
  - containerPort: 443
    hostPort: 443
    protocol: TCP

now we could see that docker has initiated 3 pods to simulate 3 nodes, and the control plane is listening on 80, 443, and 6443; the apiserver is actually running at 6443, and mapped to an empheral port at host (39645). KIND doesn’t use the default 6443 port directly on host because there could be multiple KIND clusers running on the same host.

# docker ps
CONTAINER ID   IMAGE                                                                                   COMMAND                  CREATED       STATUS          PORTS                                                                 NAMES
2936d7d97163   kindest/node:v1.31.0                                                                    "/usr/local/bin/entr…"   2 days ago    Up 38 minutes                                                                         c3-worker2
8d24b2353a3e   kindest/node:v1.31.0                                                                    "/usr/local/bin/entr…"   2 days ago    Up 38 minutes   0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp, 127.0.0.1:39645->6443/tcp   c3-control-plane
4090dcace400   kindest/node:v1.31.0                                                                    "/usr/local/bin/entr…"   2 days ago    Up 38 minutes                                                                         c3-worker
c002a6fb036c   vsc-cks-crash-course-3b2d7564edfb8b003aeb11dff1e6109bc39e0cd607995c122a7e70438649c8c8   "/bin/sh -c 'echo Co…"   11 days ago   Up 38 minutes                                                                         beautiful_swartz

then deploy the ingress-nginx and wait for it to be ready

k apply --filename https://raw.githubusercontent.com/kubernetes/ingress-nginx/master/deploy/static/provider/kind/deploy.yaml
k wait --namespace ingress-nginx --for=condition=ready pod --selector=app.kubernetes.io/component=controller --timeout=180s

let’s deploy some sample workload

apiVersion: v1
kind: Namespace
metadata:
  name: t75
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: nginx-deployment
  namespace: t75
  labels:
    app: nginx
spec:
  replicas: 3
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.14.2
        ports:
        - containerPort: 80
---
apiVersion: v1
kind: Service
metadata:
  name: accounting-service
  namespace: t75
spec:
  selector:
    app: nginx
  ports:
    - protocol: TCP
      port: 80
      targetPort: 80

now, we can pod and service in namespace t75;

# k get all -n t75
NAME                                   READY   STATUS    RESTARTS   AGE
pod/nginx-deployment-d556bf558-bm9d5   1/1     Running   0          59m
pod/nginx-deployment-d556bf558-tf6mg   1/1     Running   0          59m
pod/nginx-deployment-d556bf558-vhmm2   1/1     Running   0          59m

NAME                         TYPE        CLUSTER-IP    EXTERNAL-IP   PORT(S)   AGE
service/accounting-service   ClusterIP   10.96.164.6   <none>        80/TCP    59m

NAME                               READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/nginx-deployment   3/3     3            3           59m

NAME                                         DESIRED   CURRENT   READY   AGE
replicaset.apps/nginx-deployment-d556bf558   3         3         3       59m

let’s create the ingress to expose the accounting-service

# cat ingress.yaml

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: accounting-ingress
  namespace: t75
spec:
  tls:
  - hosts:
    - accounting.internal.acme.com
    secretName: accounting-secret
  rules:
  - host: accounting.internal.acme.com
    http:
      paths:
      - path: /
        pathType: Prefix
        backend:
          service:
            name: accounting-service
            port:
              number: 80

  # k apply -f ingress.yaml

find out the external IP address of the control plane,

codespaces-6d5b0e# k get nodes -o wide
NAME               STATUS   ROLES           AGE   VERSION   INTERNAL-IP   EXTERNAL-IP   OS-IMAGE                         KERNEL-VERSION     CONTAINER-RUNTIME
c3-control-plane   Ready    control-plane   55m   v1.31.0   172.18.0.2    <none>        Debian GNU/Linux 12 (bookworm)   6.5.0-1025-azure   containerd://1.7.18
c3-worker          Ready    <none>          55m   v1.31.0   172.18.0.4    <none>        Debian GNU/Linux 12 (bookworm)   6.5.0-1025-azure   containerd://1.7.18
c3-worker2         Ready    <none>          55m   v1.31.0   172.18.0.3    <none>        Debian GNU/Linux 12 (bookworm)   6.5.0-1025-azure   containerd://1.7.18

then add it to /etc/hosts of host,

$ cat /etc/hosts
172.18.0.2      accounting.internal.acme.com 
127.0.0.1       localhost

let’s test it from host:

# wget -q -O- https://accounting.internal.acme.com --no-check-certificate

<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

Debugging

if we want to test out the service inside the cluster

# k run tmp -n t75 --image=busybox --restart=Never -it --rm --  sh

/ # wget -q -O- accounting-service

<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

if we want to use a custom path insead of / , we need to remember to add the annotation as below

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: accounting-ingress
  namespace: t75
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
spec:
  tls:
  - hosts:
    - accounting.internal.acme.com
    secretName: accounting-secret
  rules:
  - host: accounting.internal.acme.com
    http:
      paths:
      - path: /acc
        pathType: Prefix
        backend:
          service:
            name: accounting-service
            port:
              number: 80

then, we could visit the service at /acc

# wget -q -O- https://accounting.internal.acme.com/acc --no-check-certificate

<!DOCTYPE html>
<html>
<head>
<title>Welcome to nginx!</title>
<style>
    body {
        width: 35em;
        margin: 0 auto;
        font-family: Tahoma, Verdana, Arial, sans-serif;
    }
</style>
</head>
<body>
<h1>Welcome to nginx!</h1>
<p>If you see this page, the nginx web server is successfully installed and
working. Further configuration is required.</p>

<p>For online documentation and support please refer to
<a href="http://nginx.org/">nginx.org</a>.<br/>
Commercial support is available at
<a href="http://nginx.com/">nginx.com</a>.</p>

<p><em>Thank you for using nginx.</em></p>
</body>
</html>

so in summary, in order to expose a service outside the cluster, we need a deployment with pod, and a service point to the pods, and install ingressControler (if it is not deployed in your k8s cluster by default) and ingress rule (ingress.yaml).

specificially to KIND, you need to make sure the node are ready for ingressController deployment, and expose the relevant ports when creating cluster.

how to deploy ingress to multi node KIND cluster was originally published in CI/CD/DevOps on Medium, where people are continuing the conversation by highlighting and responding to this story.