diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 0000000..ee86784
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,43 @@
+name: Semgrep
+on: 
+  workflow_dispatch: {}
+  pull_request: {}
+  push:
+    branches:
+    - main
+    - master
+    paths:
+    - .github/workflows/semgrep.yml
+  schedule:
+    # randoms HH:MM to avoid a load spike on GitHub Actions at 00:00
+    - cron: 55 14 * * *
+jobs:
+  semgrep_include:
+    strategy:
+      matrix:
+        subdir:
+          - cloud-devops-ci-cd-udapeople
+          - cloud-devops-cloudformation
+          - cloud-devops-operationalizing-ml
+          - cloud-devops-static-website  
+    name: semgrep/ci
+    runs-on: ubuntu-20.04
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+      SEMGREP_REPO_DISPLAY_NAME: monorepo-test--${{ matrix.subdir }}
+    container:
+      image: returntocorp/semgrep
+    steps:
+    - uses: actions/checkout@v3
+    - run: semgrep ci --include=${{ matrix.subdir }}
+
+  semgrep_exclude: 
+    name: semgrep/ci
+    runs-on: ubuntu-20.04
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: returntocorp/semgrep
+    steps:
+    - uses: actions/checkout@v3
+    - run: semgrep ci
diff --git a/vuln.js b/vuln.js
new file mode 100644
index 0000000..27f66f2
--- /dev/null
+++ b/vuln.js
@@ -0,0 +1,18 @@
+var app = angular.module('MyApp', []);
+app.controller('myCtrl', function($scope, $sce) {
+    $scope.userInput = 'foo';
+
+    $scope.sayHello = function() {
+     // ruleid:detect-angular-open-redirect
+     $window.location.href = input + '/app/logout';
+     input = $scope.input;
+     // ruleid:detect-angular-open-redirect
+     $window.location.href = input + '/app/logout';
+
+     //Data is not coming from user input
+     $location.location.location = test
+     // ok:detect-angular-open-redirect
+     $window.location.href = "//untatintedredirect"
+   };
+
+});