Semgrep vs Snyk

From $40 per contributor/month (indicative)

From $25 per contributing developer/month (indicative, Team)

The CLI plus community rules costs nothing and covers a lot; paid tiers add the platform, supply chain and secrets.

Priced per contributing developer. Enterprise agreements add reporting and governance and get expensive.

Open-source CLI is free and complete; hosted platform free for up to 10 contributors.

Free plan with a monthly test allowance, generous enough for small projects.

Widely used

Semgrep · since 2020

Category standard

Snyk · since 2015

• Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
• Free CLI with a large community rule registry is immediately useful.
• Fast enough to run on every pull request without complaint.

• Reachability analysis dramatically cuts the noise from transitive dependency alerts.
• Automated fix pull requests make remediation a merge rather than a project.
• One vendor covers dependencies, code, containers and IaC.

• Pattern matching without full dataflow misses some vulnerability classes.
• Community rule quality is uneven; expect to curate.
• Advanced dataflow and supply-chain features are paid only.

• Per-developer pricing scales uncomfortably in large engineering organisations.
• SAST is less deep than dedicated code-analysis vendors.
• Still produces substantial alert volume on older codebases.

Teams that want customisable static analysis and can start entirely for free.

Engineering teams that want security findings arriving in the pull request with a fix attached.