<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# API Reference — Performing Source Code Review

## semgrep — Static Analysis
```bash
# Full OWASP scan
semgrep --config=auto --config=p/owasp-top-ten --json src/

# Specific vulnerability class
semgrep --config=p/sql-injection src/
semgrep --config=p/xss src/
semgrep --config=p/command-injection src/

# Custom rule scan
semgrep --config=custom-rules/ src/

# SARIF output for CI integration
semgrep --config=auto --output=results.sarif --sarif src/
```

## CodeQL — Deep Semantic Analysis
```bash
# Create database
codeql database create db --language=python --source-root=src/

# Run security queries
codeql database analyze db codeql/python-queries:Security \
  --format=sarif-latest --output=results.sarif
```

## Bandit — Python Security Linter
```bash
# Full scan with JSON output
bandit -r src/ -f json -ll -ii

# Scan specific tests only
bandit -r src/ -t B101,B102,B103
```

## gitleaks — Secret Detection
```bash
# Scan repository
gitleaks detect --source=. --report-format=json --report-path=secrets.json

# Scan in CI (no git history)
gitleaks detect --source=. --no-git
```

## trufflehog — Credential Scanner
```bash
# Scan git history
trufflehog git file://. --json --only-verified

# Scan filesystem
trufflehog filesystem --directory=src/ --json
```
