Semgrep is a fast, pattern-based code analysis platform offering SAST (Semgrep Code), open-source dependency scanning (Supply Chain), and secret detection. Its open-source Community Edition CLI (LGPL v2.1) runs entirely locally or in CI without sending source code off-machine, while the commercial AppSec Platform adds cross-file and cross-function analysis, managed rules, and triage. The platform is free for up to 10 contributors on private repos.
sastsemgreppattern-basedappsec
Overview
- Founded
- 2017
- Pricing tier
- Mid
- Startup-friendly
- Yes
- Enterprise-ready
- Yes
App & code security (SAST/SCA)
- SAST
- Yes
- SCA
- Yes
- Secret scanning
- Yes
- DAST
- No
- Container scanning
- No
- IaC scanning
- No
- CI/CD integration
- Yes
- Open-source
- No
- Self-hostable
- Yes
- Free tier
- Yes: AppSec Platform free for up to 10 contributors on private repos; open-source CLI (Community Edition, LGPL v2.1) fully free