Our vision at Semmle is to secure software, together. Semmle is pioneering new techniques in variant analysis to quickly discover new vulnerabilities in any codebase. Today, we are very excited to announce the launch of our latest releases - LGTM 1.20 and QL 1.20, empowering security teams to be more efficient and produce better query results which are easier to interpret.
Significant performance improvements in both QL and LGTM due to the new ability to run multiple queries in parallel, using all available cores when running a single query. Measurements on code bases at customers who were involved in testing this feature show up to four times faster end-to-end analysis times when compared to last year’s June release.
Enhanced security analysis by adding 24 new queries that offer additional security analyses, and improving the support for commonly-used libraries and dependencies. This means additional sources of user data are now automatically detected, as are potentially dangerous uses (sinks) of such data. Using LGTM, it is now easy to investigate the details of data flow results: you can now explore data flow paths, all the way from the source to the sink.
The latest release and the new features continue to advance our commitment to enable developers and security teams to ship safe code and protect their customers. In the last 6 months, we have discovered and disclosed 29 CVEs in open source codebases including Apple XNU operating system kernel, Facebook Fizz, Red Hat Ansible and Ghostscript, and collaborated with security teams to avoid significant security threats, reinforcing our vision to secure software, together.
See full release notes and product documentation here:
Want to see a demo or start a trial? Contact us