Semgrep

Semgrep is a fast, open source static analysis tool that searches code, finds bugs and enforces secure guardrails and coding standards. It supports more than 30 languages and runs in an IDE, as a pre-commit check or as part of CI/CD workflows.

Semgrep works as a semantic grep for code: rules are written in a syntax that looks like the code being searched, without abstract syntax trees, regular expressions or a dedicated DSL. Semgrep Community Edition analyses code within the boundaries of a single function or file.

The Community Edition is distributed under the LGPL-2.1 and actively developed on GitHub. The commercial Semgrep AppSec Platform adds cross-file security analysis (SAST), supply chain analysis of open source dependencies (SCA), secrets detection and AI-assisted triage and remediation.