Secure Code Review: SAST with Semgrep & CodeQL

Hand review finds the deep bugs; SAST finds the shallow ones at scale. We cover how static analysis works — pattern matching versus dataflow taint — then get hands-on with Semgrep (running it, writing a rule for your own code, taint mode) and CodeQL (code as a queryable database). We finish with triaging the noise, scanning dependencies and secrets, and a CI gate that blocks only new findings.