PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Announcing the Trail of Bits and Semgrep partnership

blog.trailofbits.com | blog | #sast | #partnership | #static-analysis | #developer-tools | #code-audit | #trail-of-bits | #semgrep
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits announces a partnership with Semgrep to drive broader adoption of static analysis, calling it a first-line audit tool for finding low-complexity bugs without building the code.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
Rust-proof your code with our new Testing Handbook chapter
Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.
blog · blog.trailofbits.com
Discovering goroutine leaks with Semgrep
Go's go keyword makes concurrency easy but leaks silently: thousands of hanging goroutines can slow or crash an app. This post shares a Semgrep rule that catches a common goroutine leak pattern.
blog · borghq.io
SAST and Business Logic Vulnerabilities: What Static Analysis Can Reach
This coverage gives security teams current context for monitoring, validation, and remediation.
research · xbow.com
Tales from the Trace: How Agentic AI Merges Static and Dynamic Testing
The first Tales from the Trace shows XBOW combining source-code analysis with dynamic testing (via DVWA), guiding attacks with static knowledge and confirming them at runtime.
blog · blog.trailofbits.com
Your AI agent fixed the bug, but what else did it change?
We’re publishing patching-bugs and regression-hunt, two plugins that let engineers delegate patch development and regression checks to agents.
Back