Semgrep

Name: Semgrep
Brand: Semgrep
Price: 40 USD
Availability: InStock
Rating: 4.1 (7 reviews)

GoTypical Verified

Monthly Price$40/mo

Static analysis tool that uses pattern-based and AI-assisted rules to find security bugs and code quality issues across 30+ languages. Semgrep Code performs deep taint analysis; Semgrep Supply Chain scans open-source dependencies. Fully customizable rule sets.

WORTH IT

No Free Tier Plan

Paid only

Semgrep fills a gap in multi-language CI security scanning.

Reality check: Semgrep is valuable for CI SAST across languages but may be unnecessary where simpler tools suffice.

Time to ValueHours

Reliability Score

79%7 Trust Units

Visit Site View Alternatives

Community Reactions

Best For

Security engineers
AppSec teams
platform engineering
open-source projects
polyglot codebases
teams building custom security gates
developers who want to write own rules

Not For

Teams wanting zero-config scanning
non-technical security stakeholders
teams without CI/CD
teams needing DAST or runtime protection
no-code security setups

Micro-Feedback Feed

7 Reviews

“I'm unsure which of these tools will close the quality‑gate gap most effectively.”

NOT SURE

@guilhermegor • GitHub

5 days ago

“I think adding SAST scanning to CI is worth it; it catches vulnerabilities early.”

WORTH IT

@sshdopey • GitHub

7 days ago

“I'm not sure how reliable n8PDF's custom parsers are given the massive untrusted input and audit backlog.”

NOT SURE

@Dev-Vik-Tor • GitHub

9 days ago

“## Context n8PDF parses hostile input by design — a `.docx` is untrusted XML carrying untrusted fonts and images, and every parser was writ”

NOT SURE

@nathanpond • GitHub

9 days ago

“I think adding Semgrep, CodeQL, and Clippy checks to each PR is worth it for catching Rust/TS bugs early.”

WORTH IT

@ayomideadeniran • GitHub

9 days ago

“Semgrep is worth it for its ability to transcribe analysis/security/coverage tool output into run records.”

WORTH IT

@kreneskyp • GitHub

17 days ago

Similar Tools

1Password

Situational

Password manager and secrets manager for teams and enterprises. Stores passwords, SSH keys, API tokens, and secrets with zero-knowledge encryption. Offers developer-focused CLI and SDKs for secrets injection in CI/CD pipelines and local development.

Security$3/mo

Discussions

No discussions yet

Be the first to share your experience.

Audit ParticipationYour Experience?

Pros

Supports 30+ languages
Custom rule authoring with simple pattern syntax
5000+ community rules
Deep taint analysis
Supply chain scanning
CI/CD native
Fast scans
Free for open source

Cons

Rule-writing has a learning curve
Some false positives on complex patterns
Supply Chain features require paid tier
UI dashboard is basic on free plan
Taint analysis can miss indirect flows

Community Verdict Breakdown

57%

Worth It

4 votes

43%

Situational

3 votes

Not worth it

0 votes

Based on 7 professional audits

Micro-Feedback Feed

7 Reviews

“I'm unsure which of these tools will close the quality‑gate gap most effectively.”

NOT SURE

@guilhermegor • GitHub

5 days ago

“I think adding SAST scanning to CI is worth it; it catches vulnerabilities early.”

WORTH IT

@sshdopey • GitHub

7 days ago

“I'm not sure how reliable n8PDF's custom parsers are given the massive untrusted input and audit backlog.”

NOT SURE

@Dev-Vik-Tor • GitHub

9 days ago

“## Context n8PDF parses hostile input by design — a `.docx` is untrusted XML carrying untrusted fonts and images, and every parser was writ”

NOT SURE

@nathanpond • GitHub

9 days ago

“I think adding Semgrep, CodeQL, and Clippy checks to each PR is worth it for catching Rust/TS bugs early.”

WORTH IT

@ayomideadeniran • GitHub

9 days ago

“Semgrep is worth it for its ability to transcribe analysis/security/coverage tool output into run records.”

WORTH IT

@kreneskyp • GitHub

17 days ago

Semgrep

Micro-Feedback Feed

Similar Tools

1Password

Discussions

Socket

Dependabot

Micro-Feedback Feed