all sast
Everything I've published,
in one feed.
3 posts across writeups, research, and technical deep-dives. Filter by tag.
2026.06.12
Why I wanted my own code audit tool
Less technical than usual. The story of sek, the code audit tool I'm building: where the idea came from, my failed first attempt (spotted), the restart on Joern, the Rust backend I picked against my will, and the weird feeling of thinking you're done when you're not.
10 min
2026.04.08
Semgrep Architecture: Comprehensive Reference
A deep technical reference on how Semgrep works internally - from CLI entry-point and target discovery, through parsing, AST normalisation, pattern matching and taint dataflow analysis, to output formatting.
17 min
2025.08.02
Code auditing 101
A tour of code auditing fundamentals: manual review vs SAST, taint analysis, sink-to-source vs source-to-sink, and picking a SAST tool people will use.
21 min