Using Semgrep with Jupyter Notebook files

This report explains using Semgrep's experimental extract mode (with a newly added 'transform' option) to convert Jupyter Notebook JSON "source" arrays into Python for static analysis, enabling detection of vulnerabilities embedded in .ipynb files—illustrated by finding unsafe use of pickle deserialization—and provides an example extraction rule and command-line usage while noting the feature is experimental.