diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
new file mode 100644
index 00000000..b5e35d78
--- /dev/null
+++ b/.github/workflows/semgrep.yml
@@ -0,0 +1,24 @@
+on:
+  workflow_dispatch: {}
+  pull_request: {}
+  push:
+    branches:
+    - main
+    - master
+    paths:
+    - .github/workflows/semgrep.yml
+  schedule:
+  # random HH:MM to avoid a load spike on GitHub Actions at 00:00
+  - cron: 44 15 * * *
+name: Semgrep
+jobs:
+  semgrep:
+    name: semgrep/ci
+    runs-on: ubuntu-20.04
+    env:
+      SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}
+    container:
+      image: returntocorp/semgrep
+    steps:
+    - uses: actions/checkout@v4
+    - run: semgrep ci
diff --git a/jsmn.h b/jsmn.h
index cb27ca11..3d1509f5 100644
--- a/jsmn.h
+++ b/jsmn.h
@@ -163,11 +163,14 @@ static int jsmn_parse_primitive(jsmn_parser *parser, const char *js,
       return JSMN_ERROR_INVAL;
     }
   }
-#ifdef JSMN_STRICT
-  /* In strict mode primitive must be followed by a comma/object/array */
-  parser->pos = start;
-  return JSMN_ERROR_PART;
+#ifndef JSMN_STRICT
+  if( parser->toksuper != -1)  // if we are "inside" we may not be done yet
 #endif
+  /* In strict mode primitive must be followed by a comma/object/array */
+  {
+     parser->pos = start;
+     return JSMN_ERROR_PART;
+  }
 
 found:
   if (tokens == NULL) {