Semgrep

Semgrep is an application security platform that scans source code for vulnerabilities, dependency risks and secrets. It pairs fast static analysis with AI-assisted triage to cut down on noise.

Semgrep checks code for security issues using rules and static analysis. Its scope covers source code (SAST), open source dependencies (SCA) and leaked secrets, and it offers malware protection for open source packages. The platform sorts findings to separate likely false alarms from real risk, and it suggests fixes for the issues it reports.

• Static analysis of source code
• Checks open source dependencies for known issues
• Scans code for leaked secrets
• Triages findings to reduce false alarms
• Suggests fixes for reported issues

Application security teams that need findings they can act on are the main audience. Developers who want checks that run inside their normal tools benefit too, as do engineering leaders who need visibility across many repositories.

The scanning engine is published on GitHub under the LGPL-2.1 license. The company offers a free trial of its platform and paid plans, with a demo available on request. Check the pricing page for current options, and review how the tool handles findings before you rely on automated triage for decisions.