Semgrep review

Semgrep is an application security platform for finding and fixing code vulnerabilities. It combines static application security testing (SAST), open-source dependency checks, malware protection and secrets scanning. Its code scanner looks for vulnerabilities, while semantic analysis is used to find hardcoded secrets.

The platform also targets AI-generated code, combining AI reasoning with rule-based analysis. For triage, Semgrep says it uses code context, patterns and prior decisions to prioritize findings. It can provide tailored fixes and dependency upgrade guidance in pull requests and IDEs.

That makes Semgrep broader than a standalone SAST scanner, but it is still centered on code and its dependencies. Reddit users comparing it with broader application security platforms say DAST is a gap; we cover that trade-off below. Semgrep lists Free Edition, Teams and custom-priced Enterprise plans, with a 30-day Semgrep Guardian trial.

Semgrep’s clearest strength is code scanning with rule control. Reddit commenters describe custom rules as a reason to choose it, and some users in a Jenkins discussion say they prefer Semgrep for its speed and explanations of why a finding needs attention. Those are user reports, not a guarantee that your rule set will be quiet: a different commenter warns that community rules can be noisy on AI-generated code.

The feature mix suits teams that want SAST alongside dependency and malware checks, secrets scanning and help with remediation. Semgrep also positions its scanner for AI-generated code, pairing AI reasoning with rules rather than relying on AI alone. Its triage feature is intended to use code context and prior decisions to sort findings.

The Free Edition gives individuals and small teams a way to start without a subscription: it includes Code and Supply Chain, up to 10 contributors, up to 10 repositories and 60 AI credits. For a team that values custom checks and is prepared to own its scanning workflow, that is a useful starting point. The trade-off is that the free caps are modest.

Semgrep is not the obvious choice if you want SAST, SCA and DAST under one roof. Reddit commenters comparing it with broader platforms say it has no DAST; one also describes its SCA as shallow and says a team may need separate dependency and runtime scanners, then manage duplicate findings. That is user feedback, not a measured comparison, but it points to a real buying question: who will own the extra tools and triage queue?

The plan caps and add-on prices matter too. Free Edition is limited to 10 contributors, 10 repositories and 60 AI credits. Teams starts at $30 per contributor per month, includes 20 AI credits per developer per month and caps private repositories at 500. Listed add-ons cost $30 per contributor per month each for Code and Supply Chain, and $15 for Secrets. Enterprise pricing is custom; annual prices are not published. The 30-day Guardian trial does not establish the cost of a full deployment.

Semgrep Free Edition costs $0 and includes up to 10 contributors, 10 repositories, 60 AI credits, and Code and Supply Chain. The next listed tier, Teams, starts at $30 per contributor per month: a substantial jump from free, with 20 AI credits per developer monthly, up to 500 private repositories, and OIDC and SAML SSO. The pricing page lists Enterprise as custom, with 50 AI credits per developer monthly and unlimited repositories; it does not publish an Enterprise price.

Add-ons are listed separately: Code costs $30 per contributor monthly, Supply Chain $30, and Secrets $15. Confirm what your chosen plan includes before estimating a full bill; the published pricing details don’t specify how add-ons combine with each plan. Annual billing prices are not published, either. Semgrep lists a 30-day Semgrep Guardian free trial, which is separate from the Free Edition. Prices are in USD and listed per contributor per month where stated.

The published materials don’t describe an import process, migration service, data-export options, or how long a switch takes. They also don’t include Reddit posts, so we can’t substantiate claims about why users leave. Treat portability as an open question: ask Semgrep what you can export, including findings, triage decisions, rules, and repository configuration, before moving production workflows.

For a move to Semgrep, inventory your repositories, existing scan rules, and security tools first. Semgrep covers code scanning, dependency security, malware protection, and secrets scanning, but the published information does not establish that it replaces every tool in your stack. The verdict specifically flags the lack of DAST in one platform, so teams relying on DAST should plan for a separate product. For a move away, verify whether custom rules and prior triage decisions can be transferred; those export details are not published on the vendor's site. Don’t assume a clean exit until Semgrep confirms them.