[{"data":1,"prerenderedAt":678},["ShallowReactive",2],{"blog-semgrep-en":3},{"slug":4,"published":5,"minutes":6,"category":7,"tags":8,"keywords":14,"about":21,"sources":28,"cover":53,"og":54,"expertise":55,"locales":56,"lang":57,"title":60,"description":61,"coverAlt":62,"metaTitle":63,"takeaways":64,"faq":70,"toc":83,"blocks":108,"others":441},"semgrep","2026-08-14",10,"security",[9,10,11,12,13],"SAST","Static analysis","CI security","Rule authoring","AppSec",[4,15,16,17,18,19,20],"semgrep vs codeql","semgrep rules","semgrep pricing","semgrep pro engine","free sast tools","semgrep ci github actions",[22,25],{"name":23,"url":24},"Semgrep","https:\u002F\u002Fsemgrep.dev",{"name":26,"url":27},"Static application security testing","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FStatic_application_security_testing",[29,32,35,38,41,44,47,50],{"title":30,"url":31},"Semgrep pricing: Free, Teams and Enterprise","https:\u002F\u002Fsemgrep.dev\u002Fpricing\u002F",{"title":33,"url":34},"Semgrep Community Edition","https:\u002F\u002Fsemgrep.dev\u002Fproducts\u002Fcommunity-edition",{"title":36,"url":37},"Semgrep documentation: cross-file analysis","https:\u002F\u002Fdocs.semgrep.dev\u002Fsemgrep-code\u002Fsemgrep-pro-engine-intro\u002F",{"title":39,"url":40},"Semgrep documentation: usage and billing","https:\u002F\u002Fdocs.semgrep.dev\u002Fusage-and-billing\u002Foverview\u002F",{"title":42,"url":43},"Semgrep releases: v1.179.0","https:\u002F\u002Fgithub.com\u002Fsemgrep\u002Fsemgrep\u002Freleases",{"title":45,"url":46},"Semgrep Rules License v1.0","https:\u002F\u002Fsemgrep.dev\u002Flegal\u002Frules-license\u002F",{"title":48,"url":49},"Important updates to Semgrep OSS, 13 December 2024","https:\u002F\u002Fsemgrep.dev\u002Fblog\u002F2024\u002Fimportant-updates-to-semgrep-oss\u002F",{"title":51,"url":52},"OpenGrep repository","https:\u002F\u002Fgithub.com\u002Fopengrep\u002Fopengrep","\u002Fimages\u002Fblog\u002Fsemgrep\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fsemgrep\u002Fog.jpg","ai-engineer",[57,58,59],"en","de","hu","Semgrep: static analysis that fits in a pull request","Semgrep parses 30-plus languages and matches YAML patterns in seconds, and the engine is free under LGPL-2.1. Cross-file analysis, the rulesets and the AI triage sit behind paid tiers.","Two overlapping sheets swept by a horizontal rail with four markers, and a locked gate beyond.","Semgrep review: free SAST with a paid ceiling · Balázs Csorba",[65,66,67,68,69],"The Semgrep engine is LGPL-2.1 and scans 30-plus languages offline; cross-file analysis needs a proprietary binary and an account.","The free tier covers 10 contributors and 10 private repositories, and counts contributors from a rolling 90-day git log.","Since 13 December 2024 Semgrep-maintained rules carry the Semgrep Rules License v1.0, which forbids redistribution and service use; OpenGrep is the LGPL fork that answers it.","Cross-file analysis silently falls back to single-file after 5 GB of memory or three hours, so a large repository loses depth without failing.","AI Autofix costs 20 credits per finding against 20 monthly credits per Teams contributor, which makes autofix the most expensive action on the plan.",[71,74,77,80],{"q":72,"a":73},"Is Semgrep free to use in production?","The engine is free under LGPL-2.1 and the CLI runs without an account. The hosted free tier covers up to 10 contributors and 10 private repositories; beyond that Teams starts at $30 per contributor per month. The rules Semgrep maintains are free only for internal, non-competing use.",{"q":75,"a":76},"What is the difference between Community Edition and the Pro engine?","Community Edition analysis is intraprocedural, meaning it reasons inside a single function. The Pro engine adds cross-function analysis, which Semgrep Code runs by default, and optional cross-file analysis. It is a separate binary installed with semgrep install-semgrep-pro after semgrep login.",{"q":78,"a":79},"How accurate is Semgrep?","No precision figure is published, so the honest answer is structural: matching happens against a syntax tree, so a finding is either an exact pattern match or a rule that was written too loosely. Most noise in practice comes from rules without metavariable constraints rather than from the engine.",{"q":81,"a":82},"Does Semgrep send my source code to the cloud?","Run locally or fully in your own CI and the source stays put; only scan metadata is sent to the service. AI features submit the file containing a finding to a model, and Managed Scans clone the repository for the scan and destroy the clone afterwards.",[84,87,90,93,96,99,102,105],{"id":85,"title":86},"what-it-is","What it is",{"id":88,"title":89},"how-it-works","How it works",{"id":91,"title":92},"getting-started","Getting started",{"id":94,"title":95},"pricing","Pricing and the rules licence",{"id":97,"title":98},"scaling-in-ci","Running it in CI",{"id":100,"title":101},"where-it-shingles","Where it shingles",{"id":103,"title":104},"verdict","Verdict",{"id":106,"title":107},"sources","Sources",[109,113,116,119,122,147,148,151,157,164,174,175,178,180,207,222,223,226,265,268,271,314,322,323,326,338,339,342,388,391,392,395,407,413,414],{"type":110,"content":111},"paragraph",[112],"Semgrep is a static analyser built around pattern matching: it parses source code into a syntax tree, then reports every place where a YAML rule's pattern matches that tree. The engine is open source under LGPL-2.1, runs on a laptop with no network connection, and finishes a typical repository in seconds. The position taken here is that it is the cheapest credible first SAST tool a small team can put into CI, and that the free tier is a well-built on-ramp rather than a finished product: the analysis that removes most of the noise, the rulesets it ships with and the AI triage all sit behind a login.",{"type":110,"content":114},[115],"It sits between the linters a team already runs and the heavyweight scanners that need a security engineer to feed them. In practice it competes with CodeQL for depth, with SonarQube for the pull-request gate and with Snyk Code for developer ergonomics; the open-source fork OpenGrep competes for the licence. What it replaces most often is a folder of half-maintained grep patterns.",{"type":117,"level":118,"id":85,"text":86},"heading",2,{"type":110,"content":120},[121],"A command-line scanner plus a hosted platform. The command line does the work: give it a target directory and one or more rulesets, and it returns findings carrying the rule id, severity, message and matched range. The platform, named Semgrep AppSec Platform, adds a dashboard, policy, pull-request comments, Supply Chain, Secrets detection and the AI features. Everything below the platform is the Community Edition.",{"type":123,"ordered":124,"items":125},"list",false,[126,128,130,136,138,140,142],[127],"Engine licence LGPL-2.1; latest release 1.179.0, published 1 October 2026",[129],"30-plus languages in Community Edition, 35-plus listed for Semgrep Code",[131,132],"3,000-plus community rules, plus registry rulesets by prefix such as ",{"tag":133,"children":134},"code",[135],"p\u002Fpython",[137],"Free tier: 10 contributors, 10 private repositories, 60 AI credits a month",[139],"Teams from $30 per contributor a month; Secrets is $15",[141],"Contributors counted from the git log over a rolling 90 days",[143,144],"Cross-file analysis needs a proprietary binary from ",{"tag":133,"children":145},[146],"semgrep install-semgrep-pro",{"type":117,"level":118,"id":88,"text":89},{"type":110,"content":149},[150],"Each language has a parser, mostly tree-sitter based, that turns the file into a syntax tree. A rule is a pattern over that tree written with metavariables such as $X and $F, plus optional constraints in patterns, pattern-not, metavariable-regex and taint mode. Matching is structural rather than textual: whitespace, renamed variables and reordered statements do not hide a match, which is why the false-positive rate stays low enough for a pull-request gate.",{"type":152,"src":153,"alt":154,"wide":155,"caption":156},"image","\u002Fimages\u002Fblog\u002Fsemgrep\u002Fdiagram-7.webp","Semgrep: how a scan turns source into findings Source files are parsed into a syntax tree, matched against rule patterns, and reported as findings. Rulesets from the registry and the optional Pro engine feed the matching step, and findings leave as terminal output, JSON or SARIF.",true,"The rule decides what counts as a finding; the engine only decides where a pattern matches.",{"type":110,"content":158},[159,160,163],"Findings carry the rule id, severity and a message, and can be suppressed per line with a ",{"tag":133,"children":161},[162],"nosemgrep"," comment or per rule with an ignore entry. Output goes to the terminal, to JSON or to SARIF, which is what most dashboards ingest.",{"type":110,"content":165},[166,167,170,171,173],"The boundary that matters is scope. Community Edition analysis is intraprocedural: it reasons inside a single function. Cross-function and cross-file analysis run on the Pro engine, a separate binary that only activates after ",{"tag":133,"children":168},[169],"semgrep login"," and ",{"tag":133,"children":172},[146],".",{"type":117,"level":118,"id":91,"text":92},{"type":110,"content":176},[177],"Install the CLI with pip, pipx, uv or brew; no account is needed to scan with community rules. A rule file is small enough to sit next to the code it protects.",{"type":133,"code":179},"# rules\u002Fno-pickle.yaml\nrules:\n  - id: avoid-pickle-load\n    languages: [python]\n    severity: WARNING\n    message: |\n      pickle.load executes whatever is in the stream. Only feed it\n      bytes that never left this machine; use json.loads otherwise.\n    pattern: pickle.load($STREAM)",{"type":110,"content":181},[182,183,186,187,190,191,194,195,198,199,202,203,206],"Then run ",{"tag":133,"children":184},[185],"semgrep scan --config rules\u002Fno-pickle.yaml src\u002F"," for one ruleset, ",{"tag":133,"children":188},[189],"semgrep scan --config p\u002Fpython src\u002F"," for a registry prefix, or ",{"tag":133,"children":192},[193],"semgrep --config auto"," to let the tool choose rulesets from the languages it detects. Add ",{"tag":133,"children":196},[197],"--json"," or ",{"tag":133,"children":200},[201],"--sarif"," for machine-readable output, and ",{"tag":133,"children":204},[205],"semgrep ci"," once a repository is connected to a deployment.",{"type":208,"variant":209,"title":210,"body":211},"callout","tip","Where the source code goes",[212,220],[213,214,198,217,173],"Run it locally or fully inside your own CI and the source never leaves the machine; only Semgrep metadata is sent to the service, according to the pricing FAQ. Metrics can be switched off with ",{"tag":133,"children":215},[216],"--metrics off",{"tag":133,"children":218},[219],"SEMGREP_SEND_METRICS=off",[221],"Two things do send code out: the AI features, which submit the file containing a finding, and Managed Scans, which clone the repository for the duration of the scan and destroy the clone afterwards.",{"type":117,"level":118,"id":94,"text":95},{"type":110,"content":224},[225],"The engine is free; the interesting money sits around it. The pricing page as of October 2026 lists three plans, and the free one is capped in a way that only becomes visible at the eleventh contributor.",{"type":227,"head":228,"rows":237},"table",[229,231,233,235],[230],"Plan",[232],"Price",[234],"Limits",[236],"What it unlocks",[238,247,256],[239,241,243,245],[240],"Free",[242],"$0",[244],"10 contributors, 10 private repositories",[246],"Code and Supply Chain, 60 AI credits a month",[248,250,252,254],[249],"Teams",[251],"From $30 per contributor a month",[253],"500 private repositories",[255],"SSO, role-based access, Secrets at $15, 20 AI credits each",[257,259,261,263],[258],"Enterprise",[260],"Custom",[262],"No limit on repositories or contributors",[264],"On-prem source control, custom CI, 50 AI credits, account manager",{"type":110,"content":266},[267],"Licence is a separate question from price. The engine stays LGPL-2.1, but since 13 December 2024 the rules Semgrep maintains ship under the Semgrep Rules License v1.0, which allows internal, non-competing use and forbids redistribution or offering the rules as a service. Consultants and companies using them internally are inside those terms; a vendor building a competing SAST product on them is not. That change is what produced OpenGrep, an LGPL-2.1 fork maintained by a consortium of security vendors including Aikido, Endor Labs, Jit and Orca Security.",{"type":110,"content":269},[270],"AI features are metered separately in credits, and the costs are published. Comments on a pull request are free, triage costs one credit per finding, and Autofix, which opens a pull request with a fix, costs twenty.",{"type":227,"head":272,"rows":279},[273,275,277],[274],"AI action",[276],"Credits",[278],"What it does",[280,287,294,301,308],[281,283,285],[282],"AI comments on a pull request",[284],"0",[286],"Guidance posted on the PR",[288,290,292],[289],"AI analysis of a finding",[291],"1 per finding",[293],"Triage, remediation guidance, component tagging",[295,297,299],[296],"AI Autofix",[298],"20 per finding",[300],"Opens a pull request that fixes the finding",[302,304,306],[303],"AI-powered detection scan",[305],"Variable",[307],"Depends on scan size and complexity",[309,311,312],[310],"Agentic Workflows run",[305],[313],"Multi-step analysis, more tokens than a detection scan",{"type":208,"variant":315,"title":316,"body":317},"warn","What the AI features send",[318,320],[319],"AI analysis submits the file containing the finding to a model. Entitlement credits expire at the end of the contract and do not roll over, so a quiet quarter is a quarter of budget lost.",[321],"Autofix at 20 credits per finding makes the credit pool the real rate limit: on the Teams plan a contributor gets 20 credits a month, so one Autofix spends the whole monthly allocation.",{"type":117,"level":118,"id":97,"text":98},{"type":110,"content":324},[325],"Semgrep is unusual in that the free tier is genuinely fast, and that changes what is worth gating on. The failure modes in large repositories are about depth and memory rather than about the scan itself.",{"type":123,"ordered":124,"items":327},[328,330,332,334,336],[329],"Diff-aware scans analyse only what a pull request touched; cross-file analysis runs on full scans and never on pull-request scans.",[331],"Cross-file analysis falls back to single-file once a scan passes 5 GB of memory or three hours, so a large repository quietly loses depth instead of failing the build.",[333],"Monorepo support splits a repository into parts on every plan; distributed scans across several machines start at Teams.",[335],"Join mode, the only facility in the open engine for joining matches across rules, is documented as experimental and not actively maintained.",[337],"Rules can be shared through the registry; private rules that keep sensitive rule logic inside the organisation need Teams or above.",{"type":117,"level":118,"id":100,"text":101},{"type":110,"content":340},[341],"The ceiling arrives sooner than the pricing page suggests. Community Edition only reasons inside one function, so a tainted value crossing a helper is invisible until somebody pays for the Pro engine, and type inference and constant propagation are the same story. The second limit is rule quality: generic patterns without a metavariable constraint produce enough noise that teams learn to ignore the tool, and writing tight rules is a skill a team has to acquire. The third is arithmetic: at $30 per contributor per month on a rolling 90-day count taken from git log, anyone who committed to a private repository in that window is billed, whether or not they are still on the project.",{"type":227,"head":343,"rows":351},[344,346,348,349],[345],"Tool",[347],"Analysis depth",[12],[350],"What it costs",[352,361,370,379],[353,355,357,359],[354],"Semgrep CE",[356],"Intraprocedural, one function at a time",[358],"YAML patterns a reviewer can read",[360],"Free engine, Semgrep-maintained rules for internal use only",[362,364,366,368],[363],"CodeQL",[365],"Whole-database dataflow across files",[367],"QL, a query language with a real learning curve",[369],"Free for public repositories, GitHub Code Security otherwise",[371,373,375,377],[372],"SonarQube",[374],"Quality plus baseline security; taint on paid tiers",[376],"Custom rules need a Java plugin",[378],"Community Build free, paid tiers per instance",[380,382,384,386],[381],"Snyk Code",[383],"Dataflow in a hosted engine",[385],"Vendor-maintained rules, little to write yourself",[387],"Paid, priced per developer",{"type":110,"content":389},[390],"The opinionated version: for a team of eight, depth matters less than being read. A ruleset a developer understands and can extend in YAML will be acted on; a whole-database query language nobody has time to learn will not. The moment the threat model is dataflow across a service boundary, Semgrep CE cannot answer the question, and the $30 tier is the cheap option next to migrating the rules to QL.",{"type":117,"level":118,"id":103,"text":104},{"type":110,"content":393},[394],"Take it as the default first scanner, with the eyes open about where the paid ceiling sits.",{"type":123,"ordered":155,"items":396},[397,399,401,403,405],[398],"Use the free Community Edition when the goal is a working security gate in CI within a week and nobody on the team writes query languages.",[400],"Pay for Teams when single-function analysis produces findings developers argue with, and when SSO, a dashboard and private rules have become requirements rather than wishes.",[402],"Do not treat $30 as the price: it is $30 per contributor per month on a 90-day rolling count, and unlimited repositories, on-prem source control and custom CI integrations live in Enterprise.",[404],"Choose CodeQL when the question is how data reaches a sink across a compiled codebase, and SonarQube when the gate is about maintainability as much as security.",[406],"If the rules have to be redistributed or served to third parties, the engine without the Semgrep-maintained rulesets, or OpenGrep, is the only arrangement that needs no conversation with the vendor.",{"type":208,"variant":408,"title":409,"body":410},"note","The claim to argue with",[411],[412],"That free static analysis is good enough for most teams is defensible. That it stays enough is not: single-function analysis was a reasonable trade when Semgrep was a pattern search, and it is the reason teams pay. Anyone adopting the free tier should write down, on the day of adoption, what finding would justify the upgrade, otherwise the upgrade gets decided by an incident instead of by a plan.",{"type":117,"level":118,"id":106,"text":107},{"type":123,"ordered":155,"items":415},[416,420,423,426,429,432,435,438],[417],{"tag":418,"href":31,"children":419},"a",[30],[421],{"tag":418,"href":34,"children":422},[33],[424],{"tag":418,"href":37,"children":425},[36],[427],{"tag":418,"href":40,"children":428},[39],[430],{"tag":418,"href":43,"children":431},[42],[433],{"tag":418,"href":46,"children":434},[45],[436],{"tag":418,"href":49,"children":437},[48],[439],{"tag":418,"href":52,"children":440},[51],[442,510,580,636],{"slug":443,"published":444,"minutes":445,"category":7,"tags":446,"keywords":452,"about":465,"sources":473,"cover":504,"og":505,"expertise":55,"locales":506,"lang":57,"title":507,"description":508,"coverAlt":509},"llm-output-guardrails-moderation","2026-10-17",13,[447,448,449,450,451],"LLM security","Guardrails","Content moderation","OWASP","Output validation",[453,454,455,456,457,458,459,460,461,462,463,464],"llm output guardrails","improper output handling llm","owasp llm05","openai moderation api","omni-moderation-latest","llama guard 4","nemo guardrails streaming","markdown image exfiltration","sanitize llm output html","groundedness detection","llm content moderation production","output rails",[466,468,471],{"name":449,"url":467},"https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FContent_moderation",{"name":469,"url":470},"Cross-site scripting","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FCross-site_scripting",{"name":450,"url":472},"https:\u002F\u002Fowasp.org\u002F",[474,477,480,483,486,489,492,495,498,501],{"title":475,"url":476},"OWASP GenAI Security Project: LLM05:2025 Improper Output Handling","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm052025-improper-output-handling\u002F",{"title":478,"url":479},"OpenAI API Docs: Moderation","https:\u002F\u002Fplatform.openai.com\u002Fdocs\u002Fguides\u002Fmoderation",{"title":481,"url":482},"Meta: Llama Guard 4 model card and prompt formats","https:\u002F\u002Fwww.llama.com\u002Fdocs\u002Fmodel-cards-and-prompt-formats\u002Fllama-guard-4\u002F",{"title":484,"url":485},"NVIDIA NeMo Guardrails: Output rail streaming configuration","https:\u002F\u002Fdocs.nvidia.com\u002Fnemo\u002Fguardrails\u002Fconfigure-guardrails\u002Fyaml-schema\u002Fstreaming\u002Foutput-rail-streaming.md",{"title":487,"url":488},"Microsoft Learn: Prompt Shields in Azure AI Content Safety","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fai-services\u002Fcontent-safety\u002Fconcepts\u002Fjailbreak-detection",{"title":490,"url":491},"Microsoft Learn: Groundedness detection in Azure AI Content Safety","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fai-services\u002Fcontent-safety\u002Fconcepts\u002Fgroundedness",{"title":493,"url":494},"Microsoft Learn: Protected material detection in Azure AI Content Safety","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fazure\u002Fai-services\u002Fcontent-safety\u002Fconcepts\u002Fprotected-material",{"title":496,"url":497},"Guardrails AI documentation","https:\u002F\u002Fwww.guardrailsai.com\u002Fdocs",{"title":499,"url":500},"Vue.js docs: Security best practices","https:\u002F\u002Fvuejs.org\u002Fguide\u002Fbest-practices\u002Fsecurity.html",{"title":502,"url":503},"Simon Willison: Remote prompt injection in GitLab Duo leads to source code theft","https:\u002F\u002Fsimonwillison.net\u002F2025\u002FMay\u002F23\u002Fremote-prompt-injection-in-gitlab-duo\u002F","\u002Fimages\u002Fblog\u002Fllm-output-guardrails-moderation\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fllm-output-guardrails-moderation\u002Fog.jpg",[57,58,59],"LLM output guardrails: moderation, safe rendering and validation before anything acts","What to check after the model answers: safe Markdown rendering, schema checks before actions, moderation classifiers, streaming rails and groundedness.","Three narrowing rectangular frames stacked as a funnel, dots falling through to a tray beside a lock.",{"slug":511,"published":444,"minutes":512,"category":7,"tags":513,"keywords":517,"about":529,"sources":537,"cover":574,"og":575,"expertise":55,"locales":576,"lang":57,"title":577,"description":578,"coverAlt":579},"ai-red-teaming-checklist-llm-apps",12,[514,447,450,515,516],"AI red teaming","promptfoo","Penetration testing",[518,519,520,521,522,523,524,525,526,527,528],"ai red teaming checklist","llm red teaming","red teaming llm applications","owasp genai red teaming guide","promptfoo red team","garak llm scanner","pyrit red teaming","llm penetration testing","owasp top 10 llm 2025 testing","jailbreak testing llm app","red team rag chatbot",[530,533,536],{"name":531,"url":532},"Red team","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FRed_team",{"name":534,"url":535},"Prompt injection","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FPrompt_injection",{"name":450,"url":472},[538,541,544,547,550,553,556,559,562,565,568,571],{"title":539,"url":540},"OWASP GenAI Security Project: GenAI Red Teaming Guide (January 2025)","https:\u002F\u002Fgenai.owasp.org\u002Fresource\u002Fgenai-red-teaming-guide\u002F",{"title":542,"url":543},"OWASP GenAI Security Project: Top 10 for LLM Applications 2025","https:\u002F\u002Fgenai.owasp.org\u002Fllm-top-10\u002F",{"title":545,"url":546},"Bullwinkel et al. (Microsoft): Lessons From Red Teaming 100 Generative AI Products (2025)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2501.07238",{"title":548,"url":549},"NIST AI 600-1: Generative Artificial Intelligence Profile (July 2024)","https:\u002F\u002Fnvlpubs.nist.gov\u002Fnistpubs\u002Fai\u002FNIST.AI.600-1.pdf",{"title":551,"url":552},"Promptfoo Docs: Red team quickstart","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fquickstart\u002F",{"title":554,"url":555},"Promptfoo Docs: Red team configuration","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fconfiguration\u002F",{"title":557,"url":558},"Promptfoo Docs: Red team plugins","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fplugins\u002F",{"title":560,"url":561},"Promptfoo Docs: Red team strategies","https:\u002F\u002Fwww.promptfoo.dev\u002Fdocs\u002Fred-team\u002Fstrategies\u002F",{"title":563,"url":564},"NVIDIA garak: LLM vulnerability scanner (GitHub)","https:\u002F\u002Fgithub.com\u002FNVIDIA\u002Fgarak",{"title":566,"url":567},"Microsoft PyRIT documentation","https:\u002F\u002Fmicrosoft.github.io\u002FPyRIT\u002F",{"title":569,"url":570},"EU AI Act, Article 55: Obligations for providers of GPAI models with systemic risk","https:\u002F\u002Fartificialintelligenceact.eu\u002Farticle\u002F55\u002F",{"title":572,"url":573},"OWASP GenAI LLM Top 10 2026: final entries (GitHub)","https:\u002F\u002Fgithub.com\u002FGenAI-Security-Project\u002FGenAI-LLM-Top10\u002Ftree\u002Fmain\u002F2026\u002Ffinal","\u002Fimages\u002Fblog\u002Fai-red-teaming-checklist-llm-apps\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fai-red-teaming-checklist-llm-apps\u002Fog.jpg",[57,58,59],"AI red teaming checklist for LLM apps: what to attack before your users do","A practical red teaming checklist for LLM features: scope, OWASP 2025 test cases, promptfoo, garak and PyRIT, human testers and regression tests.","A clipboard list, then a crossed shield and a check at the end of a curved line.",{"slug":581,"published":582,"minutes":583,"category":7,"tags":584,"keywords":590,"about":601,"sources":611,"cover":630,"og":631,"expertise":55,"locales":632,"lang":57,"title":633,"description":634,"coverAlt":635},"slopsquatting-ai-package-hallucinations","2026-10-16",6,[585,586,587,588,589],"Supply chain security","Coding agents","npm","PyPI","Package hallucination",[591,592,593,594,595,596,597,598,599,600],"slopsquatting","package hallucination","ai hallucinated packages","llm package confusion attack","coding agent supply chain security","npm min-release-age","pnpm minimumReleaseAge","uv exclude-newer","npm ignore-scripts","huggingface-cli hallucinated package",[602,605,608],{"name":603,"url":604},"Typosquatting","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FTyposquatting",{"name":606,"url":607},"Supply chain attack","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FSupply_chain_attack",{"name":609,"url":610},"Hallucination (artificial intelligence)","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FHallucination_(artificial_intelligence)",[612,615,618,621,624,627],{"title":613,"url":614},"Spracklen et al.: We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (2024)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2406.10279",{"title":616,"url":617},"Lasso Security, Bar Lanyado: Diving Deeper into AI Package Hallucinations (Mar 2024)","https:\u002F\u002Fwww.lasso.security\u002Fblog\u002Fai-package-hallucinations",{"title":619,"url":620},"npm Docs: config (min-release-age, before, ignore-scripts, allow-scripts)","https:\u002F\u002Fdocs.npmjs.com\u002Fcli\u002Fv11\u002Fusing-npm\u002Fconfig",{"title":622,"url":623},"pnpm: Dependency resolution settings (minimumReleaseAge)","https:\u002F\u002Fpnpm.io\u002Fsettings\u002Fdependency-resolution",{"title":625,"url":626},"uv: Settings reference (exclude-newer, require-hashes)","https:\u002F\u002Fdocs.astral.sh\u002Fuv\u002Freference\u002Fsettings\u002F",{"title":628,"url":629},"pip documentation: Secure installs and hash-checking mode","https:\u002F\u002Fpip.pypa.io\u002Fen\u002Fstable\u002Ftopics\u002Fsecure-installs\u002F","\u002Fimages\u002Fblog\u002Fslopsquatting-ai-package-hallucinations\u002Fcover.webp","\u002Fimages\u002Fblog\u002Fslopsquatting-ai-package-hallucinations\u002Fog.jpg",[57,58,59],"Slopsquatting: when coding agents install packages that do not exist","How LLMs hallucinate package names, how attackers register them, and the registry, lockfile and agent-harness controls that stop the install.","Three boxes on a rail, the middle one hollow and offset, aligned squares on a tray below.",{"slug":637,"published":582,"minutes":583,"category":7,"tags":638,"keywords":642,"about":653,"sources":659,"cover":672,"og":673,"expertise":55,"locales":674,"lang":57,"title":675,"description":676,"coverAlt":677},"rag-poisoning-knowledge-base-attacks",[639,640,534,450,641],"RAG security","Data poisoning","Vector database",[643,644,645,646,647,648,649,650,651,652],"rag poisoning","knowledge base poisoning","poisonedrag","rag security","indirect prompt injection rag","owasp llm08 vector and embedding weaknesses","vector database security","rag data poisoning defense","hidden text prompt injection","secure rag ingestion",[654,657,658],{"name":655,"url":656},"Retrieval-augmented generation","https:\u002F\u002Fen.wikipedia.org\u002Fwiki\u002FRetrieval-augmented_generation",{"name":534,"url":535},{"name":450,"url":472},[660,663,666,669],{"title":661,"url":662},"Zou et al.: PoisonedRAG: Knowledge Corruption Attacks to Retrieval-Augmented Generation of Large Language Models (2024)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2402.07867",{"title":664,"url":665},"Greshake et al.: Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (2023)","https:\u002F\u002Farxiv.org\u002Fabs\u002F2302.12173",{"title":667,"url":668},"OWASP Gen AI Security Project: LLM08:2025 Vector and Embedding Weaknesses","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm082025-vector-and-embedding-weaknesses\u002F",{"title":670,"url":671},"OWASP Gen AI Security Project: LLM04:2025 Data and Model Poisoning","https:\u002F\u002Fgenai.owasp.org\u002Fllmrisk\u002Fllm042025-data-and-model-poisoning\u002F","\u002Fimages\u002Fblog\u002Frag-poisoning-knowledge-base-attacks\u002Fcover.webp","\u002Fimages\u002Fblog\u002Frag-poisoning-knowledge-base-attacks\u002Fog.jpg",[57,58,59],"RAG poisoning: how a few documents can steer your assistant, and how to defend the knowledge base","How attackers plant documents that RAG systems retrieve, what PoisonedRAG and OWASP show, and the ingestion, retrieval and answer controls that limit it.","Sheets feeding a container on a belt, one carrying a small block, a gate before the exit.",1792261156082]