slackhq/snow

SNOW is a security tool built by Slack that automatically scans code repositories for known security vulnerabilities. It searches through source code to find potentially dangerous patterns, things like using weak hashing algorithms (MD5 or SHA1) or calling functions that could let attackers run malicious code. When it finds issues, it sends alerts to the team. Under the hood, SNOW relies on an open-source tool called Semgrep, which does the actual pattern-matching work. You configure which languages and repositories to scan in a config file, then run a script that kicks off the analysis. The tool produces a report of rule violations, and you can set up webhooks to receive alerts in Slack or other channels. Alerts are sorted into priority levels: "high" for the most serious patterns (which you can customize), "normal" for everything else, and "errors" for cases where the scanner couldn't process part of a codebase. The tool is designed for security teams or engineering leads at companies with many code repositories. For example, if your organization has dozens of microservices written in different languages, SNOW can scan all of them daily and flag new vulnerabilities before they reach production. One nice touch: it only alerts on new vulnerabilities, so you won't get spammed with the same finding every day. Each alert includes the rule that was triggered, a plain-language description of the vulnerability, a direct link to the problematic code in GitHub, and a snippet of the offending code. To run it locally, you'll need Docker installed. The README doesn't go into much detail on setup beyond that, but the workflow is straightforward: clone the repo, edit the config file to point at your repositories, and run the scan script. The project is relatively simple, it's essentially a wrapper around Semgrep that adds prioritized alerting and multi-repository scanning, tailored for Slack's internal needs but available for others to adapt.