Semgrep
Fast static analysis with rules that read like the code they match.
Open source · LGPL-2.1 (engine)Freemium#sast#static-analysis#security#open-source
What is Semgrep?
Semgrep finds bugs and security issues using rules that look like source code with wildcards — far easier to write than AST queries. Thousands of community rules cover OWASP patterns across 30+ languages, with the open-source engine scanning locally and a commercial platform adding triage and supply-chain analysis.
User reviews
User reviews are coming soon. We’re building a moderated review system so real-world experience — good and bad — can live alongside our editorial take. In the meantime, you can share feedback or flag corrections on GitHub.