mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Engine LGPL-2.1, shelling out carries no obligation; the registry rules are under the Semgrep Rules License since 2024-12-13 and cannot ship, only our own converted rules can. Measured 4.7 s startup and 5 to 10 ms per file; converted regex and taint rules fire for Python, PHP and JavaScript; C propagation and Groovy do not; one sanitizer semantic we refuse on purpose is accepted by Semgrep. Recommendation: a Semgrep arm on the valid pilot first. Recorded in the hunter-learning-loop research note and breadth.toml. Co-Authored-By: Claude Fable 5.1 <[email protected]>