Today, we are launching greprules.io and greprules Plugin.
greprules.io is a free community hub where developers, security engineers, AppSec teams, DevSecOps teams, and AI coding-tool users can discover, inspect, download, and share OpenGrep/Semgrep-compatible SAST rules.
greprules Plugin helps users apply those rules in local development and AI-assisted coding workflows, including workflows with tools such as Claude Code, Codex, Hermes, and other coding agents.
The goal is simple:
We are making SAST rules easier to access and use.
Provally-published SAST rule packs and greprules Plugin are free to use under the Apache License 2.0.
Rules can be explored on greprules.io.
The plugin repository is available at github.com/greprules/greprules.
TL;DR
- greprules.io is a free community hub for OpenGrep/Semgrep-compatible SAST rules.
- greprules Plugin helps users apply those rules in local development and AI coding-tool workflows.
- Provally-published rule packs and greprules Plugin are free to use under Apache-2.0.
- Rules can be searched, inspected, downloaded, and shared on greprules.io.
- greprules Plugin is available at github.com/greprules/greprules.
- greprules is designed for developers, AppSec teams, DevSecOps teams, security researchers, rule authors, and AI coding-agent users.
- SAST rules can produce false positives by nature. greprules makes rules easier to access and use; it does not claim that every SAST finding is a confirmed vulnerability.
- This launch builds on our previous work: CVE to SAST Rule Generation: How We Build OpenGrep Rules from Real Patches.
Why We Built greprules
Software development is changing quickly.
With AI-assisted development and vibe coding, more people are building software than ever before. Experienced engineers are using AI coding tools to move faster. Non-traditional developers are creating prototypes, internal tools, automation scripts, and full applications. Product teams are turning ideas into code with less friction.
That shift is exciting.
It also changes how security needs to work.
Security cannot remain something that only happens after code is pushed, after a pull request is opened, or after a security team reviews the project. As more code is written with AI assistance, security checks need to become easier to access, easier to run, and easier to understand inside the workflow where code is being created.
That is why we built greprules.
greprules.io
Makes SAST rules easier to discover, inspect, download, and share.
greprules Plugin
Makes SAST rules easier to apply inside local development and AI coding-tool workflows.The hub gives users access.
The plugin brings that access into the coding workflow.
This is not about claiming that SAST rules solve every security problem. They do not.
It is about making practical security checks easier for more people to use.
What Is greprules.io?
greprules.io is a free community hub for SAST rules.
It is built for anyone who wants to use OpenGrep/Semgrep-compatible rules with less friction:
- Developers who want lightweight security checks while coding
- Vibe coders and AI-assisted builders who want accessible security checks
- AppSec teams that want to share useful rules with engineering teams
- DevSecOps teams that want reusable rule packs
- Security researchers who want to publish detection ideas
- Rule authors who want their rules to be easier to discover
- AI coding-agent users who want rules available in local workflows
On greprules.io, users can explore SAST rules and rule packs with metadata such as:
- Language
- Framework
- Severity
- Confidence
- License
- Source context
- References
- Related packs
- Usage signals
This context matters because SAST rules are not proofs.
A rule can be useful while still producing false positives in some projects. A finding can indicate something worth reviewing without proving exploitability. A rule that works well for one framework may need adjustment for another.
greprules.io is designed to make rules easier to inspect before they are used.
What Is greprules Plugin?
greprules Plugin is how users apply rules from greprules.io inside local development and AI coding-tool workflows.
A website is useful for discovery, but developers do not live only in websites. They live in editors, terminals, repositories, pull requests, and increasingly, AI coding-agent sessions.
greprules Plugin is designed to bring SAST rules closer to that workflow.
The intended flow is:
- Open a local repository.
- Use greprules Plugin.
- Fetch relevant rules or rule packs from greprules.io.
- Run OpenGrep-compatible scans locally.
- Export results as JSON or SARIF.
- Use the results inside the developer or AI-agent workflow.
For developers, this makes it easier to try security checks without manually collecting rule files.
For AI coding tools, it creates a path for agents to use SAST rules during code review, refactoring, bug fixing, and security analysis.
For security teams, it creates a way to make rule usage more accessible to the people writing code.
Rules are available on greprules.io.
greprules Plugin is available at github.com/greprules/greprules.
How greprules.io and greprules Plugin Work Together
greprules.io and greprules Plugin are designed as two parts of the same workflow.
greprules.io
Browse rules and rule packs.
Review metadata and references.
Download rules for OpenGrep-compatible scanning.
greprules Plugin
Fetch rules from greprules.io.
Apply them in a local repository.
Support AI coding-tool workflows.
Export scan results as JSON or SARIF.For a developer, the experience should be simple:
Find a rule.
Use the plugin.
Run the scan.
Review the result.
Fix what matters.For an AI coding agent, the flow is similar:
Fetch relevant rules.
Run OpenGrep-compatible checks.
Read structured results.
Help the user understand and remediate findings.The website makes the rule ecosystem visible.
The plugin makes the rules usable in practice.
This Is Not a Claim That Every Finding Is Real
We want to be precise about the role of SAST rules.
SAST rules are useful because they can quickly detect code patterns that deserve review. But static analysis has limits. Rules can be noisy. They can overmatch. They can miss context. They can produce false positives.
That is normal for SAST.
greprules does not claim that every rule will produce only true positives. It does not claim that every finding is exploitable. It does not replace security review.
Instead, greprules focuses on access and usability:
- Make rules easier to find.
- Make rules easier to inspect.
- Make rules easier to download.
- Make rules easier to run.
- Make rules easier to use with AI coding tools.
- Make rules easier to improve over time.
This is also why greprules connects naturally with AutoProof.
greprules helps users run more security checks.
AutoProof helps verify which SAST findings are real and provides evidence for remediation.
Who greprules Is For
Developers
Developers can use greprules.io to find rules and greprules Plugin to apply those rules closer to the code they are editing.
Vibe Coders and AI-Assisted Builders
People building with AI coding tools can use greprules to bring basic SAST checks into their workflow without needing to become SAST rule experts first.
AppSec Teams
Application Security teams can use greprules to share rules, review metadata, and make useful rule packs more accessible to developers.
DevSecOps Teams
DevSecOps teams can use greprules as part of local, pre-commit, agent-assisted, or broader OpenGrep-compatible workflows.
Security Researchers
Researchers can publish rule ideas, connect rules to vulnerability references, and make detection work easier for others to reuse.
Rule Authors
Rule authors can make their work easier to discover, receive feedback, and contribute to a broader rule ecosystem.
What You Can Do Today
With greprules.io and greprules Plugin, users can:
- Explore OpenGrep/Semgrep-compatible SAST rules
- Search by language, framework, CVE, CWE, severity, and license
- Inspect rule metadata
- Download individual rules
- Download rule packs
- Use rules through greprules Plugin
- Try free Apache-2.0 Provally-published rule packs
- Share rules with developers and security teams
- Use rule outputs in JSON or SARIF-based workflows
Visit greprules.io to explore available rules.
Use github.com/greprules/greprules to try greprules Plugin.
What Comes Next
We are launching greprules as an early public release, and we want feedback from developers, vibe coders, AppSec engineers, DevSecOps teams, researchers, rule authors, and AI coding-tool users.
We are focused on:
- Publishing more free Apache-2.0 rule packs
- Improving rule search and filtering
- Improving metadata and examples
- Making greprules Plugin easier to use
- Supporting more AI coding-tool workflows
- Improving OpenGrep scan flows
- Supporting JSON and SARIF outputs
- Adding more guidance for developers who are new to SAST
- Connecting SAST findings to AutoProof verification workflows
The direction is not to claim that SAST rules solve everything.
The direction is to make SAST rules easier to access and use.
Try greprules.io and greprules Plugin
The AI coding era is changing who writes software and how quickly software gets built.
Security needs to become easier to adopt in that same workflow.
That is why we are launching greprules.io and greprules Plugin.
Explore rules on greprules.io.
Try the plugin at github.com/greprules/greprules.
Read the technical background: CVE to SAST Rule Generation: How We Build OpenGrep Rules from Real Patches.