Semgrep review

Semgrep is an application security platform for scanning code and its dependencies, with a dashboard and an API surface. It combines static application security testing (SAST), supply-chain security, secrets scanning and AI-assisted analysis. The product also offers Semgrep Guardian for scanning AI-generated code, and Semgrep Workflows for building security pipelines that combine static analysis with AI.

In a software stack, Semgrep sits in the code-security stage: it finds issues, helps prioritize findings and can provide fixes or upgrade guidance in pull requests and IDEs. Its rule registry includes rules written by Semgrep and the community, and its Playground lets users write and share rules. The vendor also names a Community Edition, but the homepage does not establish how its deployment model or licence differs from the paid platform. Semgrep's listed scope is code and supply-chain security; teams needing dynamic testing should plan to evaluate a separate tool.

Semgrep exposes an API: the vendor says teams can view malware findings on the dashboard or via API. The homepage also points to pull requests and IDEs for remediation, and provides a Registry and an online Playground for finding and writing rules. It links to product documentation and a Community Slack for questions.

The homepage does not name SDKs, programming languages, a CLI, or a specific API protocol. Confirm supported SDKs and languages in Semgrep's docs before designing an integration; also verify whether your required workflow is supported through the API, a pull request or an IDE. The product describes Semgrep Workflows as a way to build and deploy security pipelines combining static analysis with AI, but the homepage does not identify the pipeline interface or its configuration format. Treat those details as an integration check, not an assumption. The published product scope covers rule-based scanning, AI reasoning, triage and remediation, rather than a stated general-purpose developer API.

Free Edition costs $0 per month and includes up to 10 contributors, 10 repositories, 60 AI credits, and Code and Supply Chain. That is a useful entry point, but its contributor and repository caps matter as a team grows. Teams starts at $30 per contributor per month, includes 20 AI credits per developer per month, supports up to 500 private repositories, and lists OIDC and SAML SSO. Enterprise has custom pricing, 50 AI credits per developer per month and unlimited repositories.

The pricing page also lists Code at $30, Supply Chain at $30 and Secrets at $15 per contributor per month as add-ons. Confirm which products are included in your specific quote before adding these to the plan price. Billing is per contributor, so headcount drives the published plan cost; AI credits have plan-level allowances, but the cost of extra credits is not published. Annual prices are not published. Semgrep Guardian has a 30-day free trial; that is separate from the Free Edition.

Semgrep names a Community Edition and provides a Registry of rules written by Semgrep and the community. Those offerings show a community component, but they do not establish the licence for the paid platform or which parts of the product are open source. The vendor doesn't publish licence, self-hosting or data-export terms on its homepage; confirm them with Semgrep before adopting it for regulated or restricted code.

The Registry and Playground may make rule authoring more portable than a workflow built entirely around proprietary detections, but migration effort will still depend on how much you rely on Semgrep-specific rules, triage decisions and platform integrations. Before rollout, test whether findings and rule configurations can be exported in the formats your existing tools accept. Also ask whether scanning can run in your environment or requires a vendor-managed service.

The published plan limits are clearest around contributors, repositories and AI credits. The vendor doesn't publish API rate limits or uptime targets on its homepage, so confirm both, along with data handling, security controls and support commitments, before putting Semgrep in a release gate. Teams should also test how rule changes affect findings and who owns remediation as the backlog grows.

Reddit commenters report that Semgrep is quick to stand up and that custom rules are a strength. Other commenters describe community-rule noise on AI-generated code, shallow SCA coverage and the need for separate tools when DAST is required. These are user reports, not a guarantee of behavior in your codebase. In another thread, a developer says Semgrep and other static-analysis tools missed a database race condition that caused duplicate charges. Use Semgrep to find code patterns and dependency risks, not as a replacement for runtime testing, review or incident controls.