I maintain a large Python microservice and run Semgrep rules against my CI pipeline. Semgrep often reports security issues in functions or branches that are never invoked (e.g. legacy handlers behind feature-flags or test helpers). Manually triaging hundreds of “vulnerabilities” slows my developers down. What techniques or tools exist to integrate reachability analysis into Semgrep scans so that false positives in dead/unreachable code are automatically filtered out? What I’ve tried Narrowing rules with --exclude-dir/exclude-rules, but this is brittle and requires constant maintenance. Post-processing Semgrep JSON with custom heuristics (e.g. looking for if False, but coverage gaps and complex call graphs still slip through. What I want Only surface findings in code paths that are executed in my production call graph Automatically suppress unreachable-code findings without manually whitelisting each file/branch Continue reading...
