Semgrep icon
Security

Semgrep

GoTypical Verified ToolGoTypical verified
Monthly price$40/mo

Static analysis tool that uses pattern-based and AI-assisted rules to find security bugs and code quality issues across 30+ languages. Semgrep Code performs deep taint analysis; Semgrep Supply Chain scans open-source dependencies. Fully customizable rule sets.

Situational
No votes yet
No free tier plan
Paid only

Reality check: No relevant discussion found.

Time to valueHours
Reliability score
70%0 trust units
Visit SiteView Alternatives

Community reactions

Best for
  • Security engineers
  • AppSec teams
  • platform engineering
  • open-source projects
  • polyglot codebases
  • teams building custom security gates
  • developers who want to write own rules
Not for
  • Teams wanting zero-config scanning
  • non-technical security stakeholders
  • teams without CI/CD
  • teams needing DAST or runtime protection
  • no-code security setups
Pros
  • Supports 30+ languages
  • Custom rule authoring with simple pattern syntax
  • 5000+ community rules
  • Deep taint analysis
  • Supply chain scanning
  • CI/CD native
  • Fast scans
  • Free for open source
Cons
  • Rule-writing has a learning curve
  • Some false positives on complex patterns
  • Supply Chain features require paid tier
  • UI dashboard is basic on free plan
  • Taint analysis can miss indirect flows
Verdict breakdown
0%

Worth it

0 votes

0%

Situational

0 votes

0%

Not worth it

0 votes

No votes yet

Real-world use cases
  • Custom security rule authoring
  • OWASP Top 10 detection
  • Supply chain vulnerability scanning
  • Code pattern enforcement
  • Secrets detection
  • CI/CD security gates
  • AppSec triage

Micro-feedback feed

4 reviews
G

I'm not sure why the Semgrep scan passes but the SARIF upload fails, and I want Semgrep reinstated for frontend, Dockerfiles, and workflows.

NOT SURE
Summarised from github.com
5 days ago
G

I'm not sure how to implement the semgrep-sast-pr-gate blueprint, especially the flow file and description block.

NOT SURE
Summarised from github.com
5 days ago
G

I'm uncertain about adding SAST to the reusable workflow, but it could broaden security coverage.

NOT SURE
Summarised from github.com
21 days ago
G

I think integrating CodeQL, Semgrep, and gitleaks into CI is valuable for comprehensive security checks.

NOT SURE
Summarised from github.com
21 days ago

Wondering if Semgrep is worth what you pay?

See it in context. Add the tools you actually use and get your real monthly spend, what overlaps, and where you could cut.

Run a free stack auditFree, no account needed

Discussions

Sign in to join the discussion.

No discussions yet

Be the first to share your experience.

Audit participationYour experience?