--- title: Semgrep Reviews meta\_title: 'Semgrep Reviews 2026: Details, Pricing, & Features | G2' meta\_description: Filter 56 reviews by the users' company size, role or industry to find out how Semgrep works for a business like yours. aggregate\_rating: rating\_value: 4.6 review\_count: 56 scale: '5' date\_modified: '2026-08-09' parent\_category: name: "DevSecOps\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t" url: https://www.g2.com/categories/devsecops --- ### Semgrep Pros and Cons: Top 5 Advantages and Disadvantages #### Quick AI Summary Based on G2 Reviews Generated from real user reviews Users value the **ease of use** of Semgrep, praising its intuitive syntax and smooth CI/CD integration. [(16 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1901393&qs=pros-and-cons#reviews) Users appreciate the **intuitive pattern-matching syntax** of Semgrep, enabling effective custom rules for various programming languages. [(14 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1902218&qs=pros-and-cons#reviews) Users appreciate Semgrep's **effective vulnerability detection** , enabling quick identification of security issues with low false positives. [(13 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1901979&qs=pros-and-cons#reviews) Users value the **scanning efficiency** of Semgrep, benefiting from rapid scans and seamless CI/CD integration. [(12 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301214&qs=pros-and-cons#reviews) Users appreciate the **robust security features** of Semgrep, enabling effective identification and remediation of vulnerabilities effortlessly. [(12 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301279&qs=pros-and-cons#reviews) Users find Semgrep **not user-friendly** , citing a steep learning curve and challenges in initial setup and customization. [(7 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301365&qs=pros-and-cons#reviews) Users note the **limited features** of Semgrep, making categorization and comprehensive analysis more challenging. [(6 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2300785&qs=pros-and-cons#reviews) Users find the **difficult learning** curve for custom rules in Semgrep challenging, impacting new user experiences and efficiency. [(5 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301091&qs=pros-and-cons#reviews) Users face a **lack of guidance** in mastering rule creation and initial setup, impacting effective tool utilization. [(5 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301044&qs=pros-and-cons#reviews) Users find the **learning curve steep** for rule writing, especially for those new to static analysis tools. [(5 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301173&qs=pros-and-cons#reviews) ### 5 Pros or Advantages of Semgrep ##### 1. Ease of Use Users value the **ease of use** of Semgrep, praising its intuitive syntax and smooth CI/CD integration. [ See 16 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1901393&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Powerful Rule Engine and Autofix, but Governance at Scale Needs Work" What do you like about Semgrep? Flexible, transparent rule engine with clear YAML syntax and data‑flow patterns, plus an extensive public registry for quick wins and customization. ##### 2. Features Users appreciate the **intuitive pattern-matching syntax** of Semgrep, enabling effective custom rules for various programming languages. [ See 14 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1902218&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Nagaraju A.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Nagaraju A.") NA Nagaraju A. Mid-Market (51-1000 emp.) 5.0/5 "Easy to Use with Great Functional Testing Capabilities" What do you like about Semgrep? I appreciate how Semgrep excels in validating and QA testing capabilities, showing good efficacy in performing these tasks. The ease of use is particu ##### 3. Vulnerability Detection Users appreciate Semgrep's **effective vulnerability detection** , enabling quick identification of security issues with low false positives. [ See 13 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1901979&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") A Verified User Mid-Market (51-1000 emp.) 5.0/5 "Excellent Tool for Code Quality and Security." What do you like about Semgrep? It is a good tool to identify the issues and security in code which can impact the quality and security. ##### 4. Scanning Efficiency Users value the **scanning efficiency** of Semgrep, benefiting from rapid scans and seamless CI/CD integration. [ See 12 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301214&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Powerful Rule Engine and Autofix, but Governance at Scale Needs Work" What do you like about Semgrep? Flexible, transparent rule engine with clear YAML syntax and data‑flow patterns, plus an extensive public registry for quick wins and customization. ##### 5. Security Users appreciate the **robust security features** of Semgrep, enabling effective identification and remediation of vulnerabilities effortlessly. [ See 12 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301279&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Flexible Rules and GitHub Integration Shine, But Needs Better Product Segmentation" What do you like about Semgrep? Semgrep offers a single platform for SAST and SCA solutions which is good, but the best part is semgrep rules they are so flexible and easy to write t ### 5 Cons or Disadvantages of Semgrep ##### 1. Not User-Friendly Users find Semgrep **not user-friendly** , citing a steep learning curve and challenges in initial setup and customization. [ See 7 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301365&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you dislike about Semgrep? The custom rule syntax took some time to learn and was not intuitive initially. Additionally, sometimes Semgrep misses complex security patterns that ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 5.0/5 "Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed" What do you dislike about Semgrep? Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id ##### 2. Limited Features Users note the **limited features** of Semgrep, making categorization and comprehensive analysis more challenging. [ See 6 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2300785&qs=pros-and-cons#reviews) See Related User Reviews ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Flexible Rules and GitHub Integration Shine, But Needs Better Product Segmentation" What do you dislike about Semgrep? Semgrep doesnt have Product wise segmentation like for organizations with multiple products you will have only projects and have to use labels to cate ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Small-Business (50 or fewer emp.) 4.5/5 "Fast, Accurate, and Seamless Integration with GitHub" What do you dislike about Semgrep? Semgrep is quite narrowly focused, concentrating primarily on security and lacking built-in scanning capabilities for other important areas such as se ##### 3. Difficult Learning Users find the **difficult learning** curve for custom rules in Semgrep challenging, impacting new user experiences and efficiency. [ See 5 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301091&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you dislike about Semgrep? The custom rule syntax took some time to learn and was not intuitive initially. Additionally, sometimes Semgrep misses complex security patterns that ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 5.0/5 "Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed" What do you dislike about Semgrep? Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id ##### 4. Lack of Guidance Users face a **lack of guidance** in mastering rule creation and initial setup, impacting effective tool utilization. [ See 5 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301044&qs=pros-and-cons#reviews) See Related User Reviews ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Powerful Rule Engine and Autofix, but Governance at Scale Needs Work" What do you dislike about Semgrep? Governance overhead at scale; maintaining org‑wide rule sets, exceptions, and updates across many repos becomes an operational burden without a dedica ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 5.0/5 "Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed" What do you dislike about Semgrep? Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id ##### 5. Learning Curve Users find the **learning curve steep** for rule writing, especially for those new to static analysis tools. [ See 5 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301173&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you dislike about Semgrep? The custom rule syntax took some time to learn and was not intuitive initially. Additionally, sometimes Semgrep misses complex security patterns that ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 5.0/5 "Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed" What do you dislike about Semgrep? Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id ![Kiko E.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Kiko E.") KE Kiko E. Engineering Manager Mid-Market (51-1000 emp.) 2/22/2023 "A Seamless Static Analysis Tool" 5/5 What do you like best about Semgrep? One of the things that I love most about Semgrep is how easy it is to use. As a static analysis tool, it has a reputation for being intimidating or difficult to integrate into existing workflows. But with Semgrep, developers don't have to worry about that at all. It seamlessly integrates with many popular code editors, version control systems, and continuous integration tools. This means that it's a breeze to set up and start using to detect potential security vulnerabilities, performance issues, and other code quality problems. But what's really cool about Semgrep is how it feels like a tool that's designed with developers in mind. The pre-built rules are incredibly comprehensive and cover a wide range of potential issues. But if you need to customize them for your project, it's easy to do so. And if you ever get stuck, the community is always there to help you out. All in all, Semgrep is a powerful tool that can help developers improve the quality of their code. But more importantly, it feels like a tool that was designed to make our lives easier. And who doesn't love that? Review collected by and hosted on G2.com. What do you dislike about Semgrep? As with any tool, Semgrep has some potential downsides to consider. Here are a few: Learning curve: While Semgrep is generally considered to be user-friendly and easy to use, there is still a learning curve to using any new tool. Some developers may need to spend some time getting familiar with Semgrep's syntax and how to write and modify rules. False positives/negatives: Like any static analysis tool, Semgrep can generate false positives (i.e., flagging code as problematic when it's not) or false negatives (i.e., failing to flag problematic code). This can be frustrating and may require some additional time and effort to sort out. Resource-intensive: Depending on the size of your codebase, running Semgrep can be resource-intensive and may slow down your development process. It's important to consider this when integrating Semgrep into your workflow and ensure that your hardware and infrastructure can handle it. Overall, these potential downsides are relatively minor compared to the benefits that Semgrep can provide. However, it's important to consider these factors when deciding whether or not Semgrep is the right tool for your project. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? The problem that Semgrep is solving is that it can be difficult for developers to manually review code for potential issues. With codebases that are constantly growing and changing, it can be easy to miss potential issues or introduce new ones. Semgrep automates this process and enables developers to quickly identify and address potential issues before they become larger problems. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerIncentivizedSource: Seller invite DD Dhaval D. Small-Business (50 or fewer emp.) 6/27/2023 "Free and open-source static code analysis tool" 4.5/5 What do you like best about Semgrep? -Installation is pretty straightforward -Supports almost all programming languages -Scans are relatively faster than other static code analysis tool -In certain cases, I have noticed results/findings from Semgrep were more accurate Review collected by and hosted on G2.com. What do you dislike about Semgrep? -There were quite a few false positives as well -Other tools such as Sonarqube has more features and provides thorough reports -Troubleshooting can be difficult Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? In my case, I use Semgrep to find initial bugs in my code and it works almost perfectly in almost all cases and pass on the report to tester to debug more and fix the same issues. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerIncentivizedSource: G2 invite SS Stéphane S. Small-Business (50 or fewer emp.) 5/29/2023 "Amazing quality product and affordable for SMBs with great support team and community !" 5/5 What do you like best about Semgrep? Semgrep helped us in no time narrowing down important vulnerabilities and focusing on what matters thanks to Semgrep Supply Chain. It is the product with the best ROI I would recommend to add to your SSDLC. it fast, extendable and customizable, with a handy CLI. Review collected by and hosted on G2.com. What do you dislike about Semgrep? Less advanced Bitbucket / Jira integration compared to GitHub but catching up fast! Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Making sure we maintain cybersecurity compliance and ensure safety of the data we process. Semgrep Supply Chain ensure we are focusing the most important security issues first. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerIncentivizedSource: Seller invite ![Verified User in Financial Services](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Financial Services") AF Verified User in Financial Services Mid-Market (51-1000 emp.) 3/24/2023 "A Highly Customizable SAST" 5/5 What do you like best about Semgrep? Semgrep is an easy-to-use and highly customizable static code analysis tool. Its intuitive interface and flexible rules library make running scans on any codebase effortless, big or small. With its active community of contributors and open-source nature, Semgrep is an essential tool for developers looking to enhance code quality and security quickly and efficiently. Review collected by and hosted on G2.com. What do you dislike about Semgrep? I have not encountered any major issues while using the product so far. During onboarding, I experienced some minor UI issues, but they did not significantly impact my overall experience. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? It helps identify potential issues before they become major problems, saving time and resources in the long run. By finding and fixing issues early on in the development process, developers can improve the overall quality of the codebase and reduce the likelihood of future problems. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Aleksandr K.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Aleksandr K.") AK Aleksandr K. Mid-Market (51-1000 emp.) 2/22/2023 "Semgrep - future of SAST" 5/5 What do you like best about Semgrep? context aware scanning that allows a security engineer to see true metrics on vulnerabilities in the code. Its offering of IaC shows how much context aware it can be with its custom data flows. Review collected by and hosted on G2.com. What do you dislike about Semgrep? It's hard to name anything in particular, but the one thing that is challenging is to get onboarded with this. There is definitely a learning curve to get started with writing your own rules. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? All things related to code security: putting security guardrails for developers in pre-commit stage, ensuring no secrets are ever committed, keeping our lockfiles with libraries up to date. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerIncentivizedSource: Seller invite ![Verified User in Information Technology and Services](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Information Technology and Services") AI Verified User in Information Technology and Services Mid-Market (51-1000 emp.) 12/30/2022 "Game-changer for application security" 5/5 What do you like best about Semgrep? The Semgrep supply chain is a boon for application and product security teams. Backed by the already solid Semgrep engine, it can quickly surface vulnerabilities that are \*actually\* vulnerabilities and materially improves our security and risk management. It feels like it gave me new superpowers. I would recommend this to any security team, along with the base product. Most importantly, the r2c engineers and support team are first-rate. They are incredibly supportive and responsive, and I felt like their most important customer every step of the way. Review collected by and hosted on G2.com. What do you dislike about Semgrep? There are very few downsides I can think of, but one that comes to mind is the ability to extend or templatize existing rules. The base rules and rulesets are good but may produce false positives without customization. I would love the ability for Semgrep to offer a way to further customize rules and layer on specificity that increase accuracy. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Semgrep saves us innumerable hours of manual work and toil. It allows us to multiply our impact, "shift left," and free up valuable time that we can use to focus on higher-impact security efforts. I can't imagine running a security program without it. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Verified User in Insurance](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Insurance") AI Verified User in Insurance Mid-Market (51-1000 emp.) 12/16/2022 "Semgrep is extremely customizable, efficient, and scalable" 4.5/5 What do you like best about Semgrep? The customization helps teams shift left. I can create my own rules to avoid false positives and decide which rules block vs. comment vs. just monitor. This helps keep the noise down, makes it easy for software developers to fix findings immediately, and block vulnerabilities from production. Review collected by and hosted on G2.com. What do you dislike about Semgrep? I can't run different rulesets at different times. I'd like the ability to run a certain subset of rules in a CI/CD pipeline to block from deploying high-fidelity findings from production; while also running a larger set of best practices and lower-fidelity rules in a separate pipeline to help us with training and fixing less concerning issues that are more complex as tech debt. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Securing code through static code analysis scanning efficiently in the CI/CD pipeline. Semgrep places the findings directly in PR comments, avoiding the need for software developers to access a different tool. We are able to customize rules to check for things that we care about and are more unique to our code base. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Verified User in Computer Software](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Computer Software") AC Verified User in Computer Software Mid-Market (51-1000 emp.) 12/8/2022 "Semgrep's custom rules are the killer SAST feature" 5/5 What do you like best about Semgrep? Custom rules and being able to fork + modify the existing rules make Semgrep a lot more valuable as a SAST tool. For certain rules, a couple of additional "pattern-not"s have reduced our false-positive rate by as much as 30%. That kind of thing is easy in Semgrep and pretty much impossible with all other SAST tools I've used. Many other providers claim that you don't need that capability with their tools; because they have teams of people who already improve their false-positive rate. In reality, I've found Semgrep's approach works much better to cut down on spurious results. Review collected by and hosted on G2.com. What do you dislike about Semgrep? Semgrep App is still noticeably immature. There are many minor bugs around the editor, creating private rules, and the rule board. I haven't found any without some sort of workaround thus far, and R2C's support team is extremely responsive. On balance, the upsides of centralizing your rule management and having a single pane of glass to view all findings are worth the sometimes buggy UI and lacking features (such as the inability to delete rules published via the CLI). Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Semgrep solves static analysis for us. We're using it across all of our repositories and using custom rules to catch common mistakes our team makes. Compared to our previous SAST tool (Veracode), Semgrep scans much more quickly, and our developers love how much easier it is to triage findings. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Verified User in Financial Services](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Financial Services") AF Verified User in Financial Services Mid-Market (51-1000 emp.) 12/13/2022 "Easy to extend with custom rules but bumped into lots of bugs" 4/5 What do you like best about Semgrep? Easy to add custom rules (e.g. by using the online rule editor). Also, Semgrep App has some nice, convenient features (like private rule repository). Review collected by and hosted on G2.com. What do you dislike about Semgrep? Most of the paid Semgrep features can be worked around with the open source version (e.g. using a private git repository to store private rules), so I am not 100% sure the Semgrep Team license and the whole Semgrep App are mature enough to justify the price tag. Also, we ran into many bugs since we started to roll it out within the organization. The good news is that Semgrep Support is responsive (although with 9 hours time zone diff); the bad news is that I require their help constantly since I find 1-2 new bugs every week. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Preventing secrets and vulnerable code from being committed to git repositories by running Semgrep automatically as part of our CI/CD pipeline. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Jovin L.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Jovin L.") JL Jovin L. Application Security Lead Enterprise (\> 1000 emp.) 12/8/2022 "Semgrep works really well in Devsecops environments" 5/5 What do you like best about Semgrep? Semgrep is quick and allows us to write additional rules very easily. This makes it very effective, and there is support for a lot of languages. The dashboard is user friendly and its easy to look for findings reported. Review collected by and hosted on G2.com. What do you dislike about Semgrep? Semgrep does not show co-relation with multiple files. For example if an input is not filtered and is reflected on another page where it would get rendered it would be difficult to identify inSemgrep. Finding a way to have co-relation between multiple files would be great to have. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Semgrep allows to run vast number of scans across a large set of repos. That helps in a devsecops environment. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ## Top-Rated Alternatives [ ![SonarQube](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "SonarQube") SonarQube 4.4/5(155) ](https://www.g2.com/products/sonarqube/reviews) [ ![Snyk](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Snyk") Snyk 4.5/5(135) ](https://www.g2.com/products/snyk/reviews) [ ![GitHub](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "GitHub") GitHub 4.7/5(2,397) ](https://www.g2.com/products/github/reviews) [ View All Alternatives ](https://www.g2.com/products/semgrep/competitors/alternatives) ##### Categories on G2 [Vulnerability Scanner](https://www.g2.com/categories/vulnerability-scanner)[Software Composition Analysis](https://www.g2.com/categories/software-composition-analysis)[Static Application Security Testing (SAST)](https://www.g2.com/categories/static-application-security-testing-sast) [Vulnerability Scanner](https://www.g2.com/categories/vulnerability-scanner)[Software Composition Analysis](https://www.g2.com/categories/software-composition-analysis)[Static Application Security Testing (SAST)](https://www.g2.com/categories/static-application-security-testing-sast)[Secure Code Review](https://www.g2.com/categories/secure-code-review)[Dynamic Application Security Testing (DAST)](https://www.g2.com/categories/dynamic-application-security-testing-dast)[Static Code Analysis](https://www.g2.com/categories/static-code-analysis)[AI AppSec Assistants](https://www.g2.com/categories/ai-appsec-assistants)[Interactive Application Security Testing (IAST)](https://www.g2.com/categories/interactive-application-security-testing-iast) [Show MoreShow Less](javascript:void(0);) ##### Explore More [Best MDR software for small business security](https://www.g2.com/discussions/best-mdr-software-for-small-business-security)[Which audience intelligence platforms are worth using for a brand that wants to understand how their target audience compares to competitors' audiences without a full market research engagement?](https://www.g2.com/discussions/which-audience-intelligence-platforms-are-worth-using-for-a-brand-that-wants-to-understand-how-their-target-audience-compares-to-competitors-audiences-without-a-full-market-research-engagement%20)[Which CCM platform is the most user-friendly for startups](https://www.g2.com/discussions/which-ccm-platform-is-the-most-user-friendly-for-startups) [Which cloud-based capital project management systems have the strongest financial controls for a project controls team that needs audit-ready cost reporting without manual reconciliation?](https://www.g2.com/discussions/which-cloud-based-capital-project-management-systems-have-the-strongest-financial-controls-for-a-project-controls-team-that-needs-audit-ready-cost-reporting-without-manual-reconciliation%20)[best compensation management software](https://www.g2.com/discussions/need-help-what-s-the-best-compensation-management-software-solution)[Pros and Cons Details](https://www.g2.com/products/semgrep/reviews?qs=pros-and-cons) [Show MoreShow Less](javascript:void(0);)