Semgrep
Fast, open-source SAST with readable custom rules and AI triage — 30+ languages.
About
Semgrep is a lightweight static-analysis engine for finding security issues in code, with an open-source CLI core (LGPL-2.1) that scans 30+ languages in 10–30 seconds. Its standout trait is rule transparency: rules are YAML with code-like syntax that developers can read, customize, and extend, backed by a large public rule registry. The commercial AppSec platform adds cross-file taint analysis, Semgrep Assistant for AI-powered triage, supply-chain scanning with reachability, and secrets detection with validation. Teams of up to 10 contributors get the full platform free; Team pricing is $35/contributor/month.
The honest picture: the open-source engine is limited to single-file analysis, so it misses cross-file vulnerabilities unless you pay up or write custom rules. Many capabilities that were once accessible — taint analysis, SCA, secrets — now sit behind the paid tiers, and you will need to tune rules to keep noise down in large monorepos.
What it can do
- Pattern-based SAST across 30+ languages
- Custom YAML rules with readable syntax
- Semgrep Assistant AI triage
- Supply-chain scanning with reachability
- Secrets detection with validation
- Open-source CLI core (LGPL-2.1)
Setup
Install the single-binary CLI or connect repos to Semgrep Cloud; select managed rule packs or write your own.
Prerequisites
A repository to scan; CI integration for continuous scanning.
Use cases
Works with
Trust score — 8/10
Scored 8/10 (verified tier, metrics-v1). Evidence: Verified via vendor site/docs/GitHub and reputable coverage, wave 50; Trending score 82/100 from researcher assessment.