Disclosure: I work at Semgrep but figure other engineers may find the approach we used interesting.