Free Semgrep Caught Only 3 of 10 Planted Vulnerabilities in React App Test

A small development team deliberately introduced 10 common security vulnerabilities into a React and TypeScript application to evaluate how much the free, zero-config version of Semgrep could detect. Running the tool via GitHub Actions using the default '--config=auto' setting, Semgrep identified only 3 of the 10 weaknesses. The team noted this gap reflects the inherent design of static analysis tools, which match code patterns against predefined rules rather than executing the program. Vulnerabilities requiring detection of absent logic — such as missing authorization checks or CSRF tokens — are difficult to express as pattern-based rules. The experiment highlights that free SAST scanning provides limited but fast coverage, and should not be treated as a comprehensive security solution without custom rules or additional tooling.