variant-analysis

Start with an exact-match ripgrep pattern for the known vulnerable code, then generalize one element at a time using Semgrep metavariables and wildcards. Verify matches after each step and stop when the false positive rate exceeds roughly 50 percent.

Use Semgrep for fast iteration, simple patterns, and code that does not build; use CodeQL when you need cross-function interprocedural data flow analysis. Ripgrep works best for initial reconnaissance to find hotspots before deeper analysis.

Define pattern-sources such as request.args.get or req.query, pattern-sinks such as os.system or cursor.execute, and pattern-sanitizers like shlex.quote, then set mode to taint. The Skill provides ready-made templates for Python, JavaScript, Java, Go, and C/C++.

Searches scoped only to the module where the original bug was found miss variants elsewhere in the codebase. Always run patterns against the entire repository root and enumerate semantically related functions, such as isAdmin or isVerified alongside isAuthenticated.

Acceptable rates depend on context: under 5 percent for CI blocking, under 20 percent for developer warnings, under 50 percent for audit triage, and up to 80 percent for exploratory research. Filter common false positives by excluding test directories and adding sanitizer patterns.

Do not use it for initial vulnerability discovery, general code review without a known pattern, or writing fix recommendations. It requires an already-identified bug with an understood root cause as its starting point.