Semgrep
Application security scanning for code, dependencies and secrets
About Semgrep
Semgrep provides static analysis and application security tooling that scans code, open-source dependencies and secrets in CI pipelines, built on its open-source engine. It is used by development and security teams.
Common use cases
- Secure code review
- Supply chain security
- Shift-left security
Products and services
Semgrep Code
Static application security testing.
Semgrep Supply Chain
Dependency vulnerability scanning.
Semgrep Secrets
Secret detection.
Key features
- Static analysis
- Dependency scanning
- Secrets detection
- CI integration
- Custom rules
- Open-source engine
Integrations
- GitHub
- GitLab
- Jenkins
- Slack
- Jira
Semgrep alternatives
- SNSnyk
- CHCheckmarx
- SOSonarQube
- GAGitHub Advanced Security
FAQs
Who is Semgrep designed for?
Development and application security teams.
How is Semgrep delivered?
Delivery model: Cloud (SaaS), Open source.
How is Semgrep priced?
Free tier; per-contributor paid plans.
Work at Semgrep? Request updates to this profile. Update this profile
Compare with similar providers
All Integrations and DevOps providersAkuityManaged Argo CD and Kargo platform for software delivery
AllstacksEngineering intelligence for product delivery, AI impact and cost capitalization
ApplitoolsVisual AI test automation for web and mobile applications
BuildkiteCI/CD platform with self-hosted build agents
ChainguardSecure, minimal container images and software supply chain tooling
CircleCIHosted continuous integration and delivery platform
CloudBeesEnterprise software delivery platform built on Jenkins
CoderSelf-hosted cloud development environments for developers and AI agents