Semgrep Pros and Cons: Top 5 Advantages and Disadvantages

Quick AI Summary Based on G2 Reviews

Generated from real user reviews

Users appreciate the ease of use of Semgrep, enabled by its intuitive syntax and smooth integration with CI/CD. (16 mentions)

Users appreciate the flexibility and speed of Semgrep in enforcing coding standards and catching vulnerabilities effectively. (14 mentions)

Users appreciate the effective vulnerability detection of Semgrep, facilitating quick identification and resolution of security issues. (13 mentions)

Users appreciate the scanning efficiency of Semgrep, benefiting from rapid scans and streamlined CI/CD integration. (12 mentions)

Users value Semgrep for its effective security vulnerability detection, enabling quick resolutions without hindering development speed. (12 mentions)

Users find Semgrep not user-friendly due to a steep learning curve and complex initial setup requirements. (7 mentions)

Users find the limited features of Semgrep restrict its usability and complicate effective vulnerability management. (6 mentions)

Users find the difficult learning curve for Semgrep daunting, especially for creating advanced rules and setups. (5 mentions)

Users express concerns about the lack of guidance in creating custom rules, complicating effective use of Semgrep. (5 mentions)

Users note a steep learning curve for Semgrep's rule syntax, making it challenging for newcomers to master. (5 mentions)

5 Pros or Advantages of Semgrep

1. Ease of Use

Users appreciate the ease of use of Semgrep, enabled by its intuitive syntax and smooth integration with CI/CD.

See 16 mentions

See Related User Reviews

Shreekanth k.

Enterprise (> 1000 emp.)

5.0/5

"Streamlined Code Security with Semgrep"

What do you like about Semgrep?

I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr

Verified User

Enterprise (> 1000 emp.)

4.5/5

"Powerful Rule Engine and Autofix, but Governance at Scale Needs Work"

What do you like about Semgrep?

Flexible, transparent rule engine with clear YAML syntax and data‑flow patterns, plus an extensive public registry for quick wins and customization.

2. Features

Users appreciate the flexibility and speed of Semgrep in enforcing coding standards and catching vulnerabilities effectively.

See 14 mentions

See Related User Reviews

Shreekanth k.

Enterprise (> 1000 emp.)

5.0/5

"Streamlined Code Security with Semgrep"

What do you like about Semgrep?

I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr

Nagaraju A.

Mid-Market (51-1000 emp.)

5.0/5

"Easy to Use with Great Functional Testing Capabilities"

What do you like about Semgrep?

I appreciate how Semgrep excels in validating and QA testing capabilities, showing good efficacy in performing these tasks. The ease of use is particu

3. Vulnerability Detection

Users appreciate the effective vulnerability detection of Semgrep, facilitating quick identification and resolution of security issues.

See 13 mentions

See Related User Reviews

Shreekanth k.

Enterprise (> 1000 emp.)

5.0/5

"Streamlined Code Security with Semgrep"

What do you like about Semgrep?

I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr

Verified User

Mid-Market (51-1000 emp.)

5.0/5

"Excellent Tool for Code Quality and Security."

What do you like about Semgrep?

It is a good tool to identify the issues and security in code which can impact the quality and security.

4. Scanning Efficiency

Users appreciate the scanning efficiency of Semgrep, benefiting from rapid scans and streamlined CI/CD integration.

See 12 mentions

See Related User Reviews

Shreekanth k.

Enterprise (> 1000 emp.)

5.0/5

"Streamlined Code Security with Semgrep"

What do you like about Semgrep?

I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr

Verified User

Enterprise (> 1000 emp.)

4.5/5

"Powerful Rule Engine and Autofix, but Governance at Scale Needs Work"

What do you like about Semgrep?

Flexible, transparent rule engine with clear YAML syntax and data‑flow patterns, plus an extensive public registry for quick wins and customization.

5. Security

Users value Semgrep for its effective security vulnerability detection, enabling quick resolutions without hindering development speed.

See 12 mentions

See Related User Reviews

Shreekanth k.

Enterprise (> 1000 emp.)

5.0/5

"Streamlined Code Security with Semgrep"

What do you like about Semgrep?

I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr

Verified User

Enterprise (> 1000 emp.)

4.5/5

"Flexible Rules and GitHub Integration Shine, But Needs Better Product Segmentation"

What do you like about Semgrep?

Semgrep offers a single platform for SAST and SCA solutions which is good, but the best part is semgrep rules they are so flexible and easy to write t

5 Cons or Disadvantages of Semgrep

1. Not User-Friendly

Users find Semgrep not user-friendly due to a steep learning curve and complex initial setup requirements.

See 7 mentions

See Related User Reviews

Shreekanth k.

Enterprise (> 1000 emp.)

5.0/5

"Streamlined Code Security with Semgrep"

What do you dislike about Semgrep?

The custom rule syntax took some time to learn and was not intuitive initially. Additionally, sometimes Semgrep misses complex security patterns that

Verified User

Enterprise (> 1000 emp.)

5.0/5

"Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed"

What do you dislike about Semgrep?

Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id

2. Limited Features

Users find the limited features of Semgrep restrict its usability and complicate effective vulnerability management.

See 6 mentions

See Related User Reviews

Verified User

Enterprise (> 1000 emp.)

4.5/5

"Flexible Rules and GitHub Integration Shine, But Needs Better Product Segmentation"

What do you dislike about Semgrep?

Semgrep doesnt have Product wise segmentation like for organizations with multiple products you will have only projects and have to use labels to cate

Verified User

Small-Business (50 or fewer emp.)

4.5/5

"Fast, Accurate, and Seamless Integration with GitHub"

What do you dislike about Semgrep?

Semgrep is quite narrowly focused, concentrating primarily on security and lacking built-in scanning capabilities for other important areas such as se

3. Difficult Learning

Users find the difficult learning curve for Semgrep daunting, especially for creating advanced rules and setups.

See 5 mentions

See Related User Reviews

Shreekanth k.

Enterprise (> 1000 emp.)

5.0/5

"Streamlined Code Security with Semgrep"

What do you dislike about Semgrep?

The custom rule syntax took some time to learn and was not intuitive initially. Additionally, sometimes Semgrep misses complex security patterns that

Verified User

Enterprise (> 1000 emp.)

5.0/5

"Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed"

What do you dislike about Semgrep?

Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id

4. Lack of Guidance

Users express concerns about the lack of guidance in creating custom rules, complicating effective use of Semgrep.

See 5 mentions

See Related User Reviews

Verified User

Enterprise (> 1000 emp.)

4.5/5

"Powerful Rule Engine and Autofix, but Governance at Scale Needs Work"

What do you dislike about Semgrep?

Governance overhead at scale; maintaining org‑wide rule sets, exceptions, and updates across many repos becomes an operational burden without a dedica

Verified User

Enterprise (> 1000 emp.)

5.0/5

"Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed"

What do you dislike about Semgrep?

Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id

5. Learning Curve

Users note a steep learning curve for Semgrep's rule syntax, making it challenging for newcomers to master.

See 5 mentions

See Related User Reviews

Shreekanth k.

Enterprise (> 1000 emp.)

5.0/5

"Streamlined Code Security with Semgrep"

What do you dislike about Semgrep?

The custom rule syntax took some time to learn and was not intuitive initially. Additionally, sometimes Semgrep misses complex security patterns that

Verified User

Enterprise (> 1000 emp.)

5.0/5

"Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed"

What do you dislike about Semgrep?

Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id

Top-Rated Alternatives

View All Alternatives

Avneesh J.

Engineering manager-DevOps

Enterprise (> 1000 emp.)

10/28/2025

"Effortless Code Scanning—Much Easier Than Our Old Tool"

5/5

What do you like best about Semgrep?

It's a very user-friendly tool for scanning code repositories, and I find it much easier to use compared to our previous Checkmarx scan.

Its quiet easy to integrate with our existing code repository and can also be filtered based on the need. Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

Since we have only recently started using this tool, there is nothing we dislike about it so far. Review collected by and hosted on G2.com.

Mahmoud H.

Information Security Intern

Mid-Market (51-1000 emp.)

9/16/2025

"I think Semgrep is a must have for every Software Company"

4.5/5

What do you like best about Semgrep?

The fact that it can scan dependencies and has so many rules configured on the spot, with a very friendly and easy to use UI for the SemGrep pro. Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

I think what semgrep needs is a feature that summarizes the overall security standing of a repository/project. And to allow the user to be able to tell the platform the links between different repos/ if there are any. Review collected by and hosted on G2.com.

Nitish U.

Product Security Lead

Computer & Network Security

Mid-Market (51-1000 emp.)

4/13/2026

"Accurate Results and a Polished UI from Semgrep"

4.5/5

What do you like best about Semgrep?

Accuracy, UI. Semgrep AI assistant. Semgrep SCA reachability matrix Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

Bugs, Crashes. Frequent issues in PR scans. Review collected by and hosted on G2.com.

Verified User in Computer Software

Mid-Market (51-1000 emp.)

9/12/2025

"Enhancing Security with Semgrep"

4/5

What do you like best about Semgrep?

Since it runs fast and integrates directly into CI/CD, my team can surface issues early — from insecure function use to misconfigured patterns — before they ever hit production. Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

Filter limitations and changing some settings at the global level using UI. Having more advanced filtering and project-level controls would make it easier to manage findings across different environments, prioritize risks. Review collected by and hosted on G2.com.

What problems is Semgrep solving and how is that benefiting you?

The biggest benefit for us is automation and consistency. By integrating Semgrep into CI/CD pipelines, I can enforce secure coding practices at scale and ensure that every pull request is checked for common vulnerabilities. This reduces reliance on manual reviews, lowers the chance of critical bugs slipping into production, and frees me up to focus on more complex security work like pentesting and cloud security design. Review collected by and hosted on G2.com.

Siddhesh J.

Senior Security Analyst & Consultant

Information Technology and Services

Mid-Market (51-1000 emp.)

9/8/2025

"Fast and positive results"

4.5/5

What do you like best about Semgrep?

There are multiple things which is great in the SemGrep tool, 1st easy integration with GSM and CI-CD pipeline, 2nd is easy terminal based code scan which save lot of time and intergration if Code is small. Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

Not specific as such, since everything is good in right price. Review collected by and hosted on G2.com.

Andrew K.

Systems Administrator

Enterprise (> 1000 emp.)

10/21/2025

"Effortless Code Scanning, But Dynamic Issues Can Slip Through"

2.5/5

What do you like best about Semgrep?

Our company has it automatically enabled to scan our code. We can click a link and see what items need to be addressed. I get a review of my code every commit. Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

I can hide security issues with dynamically loaded variables and methods Review collected by and hosted on G2.com.

Verified User in Computer Software

Small-Business (50 or fewer emp.)

9/9/2025

"Hands-off setup could not be easier"

4.5/5

What do you like best about Semgrep?

Very little had to be done on our end to set up managed scans for the entire GitHub organization. Aside from Semgrep staff adjusting things to get a scan to complete, or large codebase was running SAST scans in a few days. Github PR comments show users what to do, and AI can classify many reports correctly as not needing mitigation. Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

Semgrep's features are designed around preventing new problems from being introduced in pull requests, but those same features are not available for issues found on trunk branches - these have to be dealt with manually. Review collected by and hosted on G2.com.

Verified User in Semiconductors

Enterprise (> 1000 emp.)

10/21/2025

"Insightful Vulnerability Analysis, But Needs Automatic Analysis"

5/5

What do you like best about Semgrep?

The tool provides an analysis of detected vulnerabilities in the code and also offers suggested fixes. This feature is helpful for identifying potential issues and understanding how to address them. Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

Currently, I have to manually trigger the analysis each time a new detection occurs, but I would prefer if the analysis happened automatically as soon as something is detected. Review collected by and hosted on G2.com.

Verified User in International Affairs

Enterprise (> 1000 emp.)

10/21/2025

"Speeds Up Bug Detection, But Rule Syntax Can Be Limiting for Complex Code"

4/5

What do you like best about Semgrep?

The best thing about Semgrep is that it helps catch bugs and enforce code standards early in development, without slowing engineers down. It’s quick, understandable, and fits naturally into the developer workflow. Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

My main dislike is that Semgrep’s rule syntax can feel restrictive when dealing with dynamic code or frameworks that rely heavily on metaprogramming. It’s great for straightforward patterns, but deeper semantic analysis sometimes needs more manual effort. Review collected by and hosted on G2.com.

Verified User in Hospital & Health Care

Enterprise (> 1000 emp.)

10/30/2025

"Flexible Rules and GitHub Integration Shine, But Needs Better Product Segmentation"

4.5/5

What do you like best about Semgrep?

Semgrep offers a single platform for SAST and SCA solutions which is good, but the best part is semgrep rules they are so flexible and easy to write that you dont need to manually do filtering or removing.

The tool has another feature I personally like is github actions that will show bugs in git itself with an AI reviewed fixed version. Review collected by and hosted on G2.com.

What do you dislike about Semgrep?

Semgrep doesnt have Product wise segmentation like for organizations with multiple products you will have only projects and have to use labels to categorise those products. Review collected by and hosted on G2.com.