How we implemented inter-file analysis to find the vulnerabilities that matter

If you’ve used Semgrep OSS to find vulnerabilities, you might have noticed it misses vulnerabilities that scan multiple files. Or, you might have noticed that it picks up false positives that could have been eliminated with deeper analysis. We certainly did—and that’s why we made Semgrep Pro engine.

You might be thinking: so many users have probably asked for these features since the initial releases of Semgrep! You are right. You might also be thinking: developing a product that so many users have already demanded and have opinions on must be a product manager’s utopia! Well, turns out it’s harder than that.

In this webinar, Colleen and Emma will share:

• How they learned the hard way that you can’t base all development of a product on user feedback.

• How they collaborated across teams in order to simultaneously create a benchmark of what to match and quickly develop Semgrep’s interfile analysis.

• How we built and successfully released a developer-focused interfile engine in just 5 months.