Custom SAST Rules That Catch What Defaults Miss
By Richard Augenti
Write, test and tune your own static analysis rules against a vulnerable codebase, then judge them on false positives as well as on what they catch.
Free to browse. Takes about 60 minutes once you start.
Lab Overview
The payments-api team has a Semgrep ruleset maintained by security, and nobody runs it in the pipeline.
In this lab you scan the codebase and triage what comes back - one finding is a real vulnerability and one is not a bug at all - then write a rule for a policy no off-the-shelf ruleset could know about, and enforce both in CI. The triage half matters as much as the writing half: fixing and suppressing are both legitimate outcomes, and telling them apart is the skill.
Semgrep runs as a container on your lab machine, so there is nothing to install and no versions to reconcile. Everything is local.
What to Expect
- Environment: a single Ubuntu machine you connect to over SSH, with the payments-api repository and the security ruleset in place. Semgrep runs as a container. No cluster required.
- Access: SSH credentials are generated for your session and shown in the workspace. They are destroyed when the lab ends.
- Checking your work: verify.sh machine-checks each objective, and setup.sh --force rebuilds the lab from scratch if you want to start over.
- Progress: your work is not saved. If the lab expires or you quit, the machine and everything on it is destroyed.
What are hands-on labs?
A lab is a real environment, not a simulation. You get a live machine with the tooling already installed, a task taken from production work, and root access to take it apart. Nothing is mocked, nothing is multiple choice. It either works or it doesn't.
Real tooling
The same commands you would run at work, on a machine that is already set up for them. No screenshots, no sandboxed toy version.
Break it freely
Everything is disposable. When the clock runs out the environment is destroyed with everything in it, so there is no reason to be careful.
Useful on Monday
Built by engineers who run these systems in production. Skills you can apply to your own stack the same week, not exam preparation.