Semgrep
Pattern-based static analysis where rules look like the code they match.
What it is
Semgrep lets you write rules that resemble the source code being matched rather than AST queries, which makes custom rules genuinely writable by ordinary developers. It ships thousands of community rules for security and correctness across many languages, and adds supply-chain and secrets scanning in the commercial tiers.
Best for
Where it is strong
- Custom rules are genuinely writable — you can encode your own security or architecture standards in an afternoon.
- Free CLI with a large community rule registry is immediately useful.
- Fast enough to run on every pull request without complaint.
Where it falls short
- Pattern matching without full dataflow misses some vulnerability classes.
- Community rule quality is uneven; expect to curate.
- Advanced dataflow and supply-chain features are paid only.
Pricing
From $30 per contributor/month (Teams, per product)
Free tierFree tier: Open-source CLI is free and complete; hosted platform free for up to 10 contributors.
What drives the bill: The CLI plus community rules costs nothing and covers a lot. Teams is priced per product per contributor — Code $30, Supply Chain $30, Secrets $15 — so scanning for all three multiplies the per-contributor figure.
Check current pricing on Semgrep’s siteFigures are indicative and were last reviewed August 2026. Vendors change pricing often; confirm before you commit.
Works with
What people who use Semgrep say
No reviews of Semgrep yet. If you have used it in anger, yours would be the first.
Alternatives to Semgrep
If Semgrep is not the right fit, these solve the same problem differently.
Snyk
Security Testing
Developer-first security across dependencies, code, containers and infrastructure.
SonarQube
Code Quality
The static-analysis standard: 30+ languages, quality gates, clean-as-you-code.
Checkmarx One
Security Testing
Enterprise application security platform: SAST, SCA, DAST, IaC and API security.
CodeQL
Security Testing
Query your codebase like a database to find vulnerability patterns across the whole repo.