--- title: Semgrep Reviews meta\_title: 'Semgrep Reviews 2026: Details, Pricing, & Features | G2' meta\_description: Filter 56 reviews by the users' company size, role or industry to find out how Semgrep works for a business like yours. aggregate\_rating: rating\_value: 4.6 review\_count: 56 scale: '5' date\_modified: '2026-08-09' parent\_category: name: "DevSecOps\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t" url: https://www.g2.com/categories/devsecops --- ### Semgrep Pros and Cons: Top 5 Advantages and Disadvantages #### Quick AI Summary Based on G2 Reviews Generated from real user reviews Users value the **ease of use** of Semgrep, praising its intuitive syntax and smooth CI/CD integration. [(16 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1901393&qs=pros-and-cons#reviews) Users appreciate the **intuitive pattern-matching syntax** of Semgrep, enabling effective custom rules for various programming languages. [(14 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1902218&qs=pros-and-cons#reviews) Users appreciate Semgrep's **effective vulnerability detection** , enabling quick identification of security issues with low false positives. [(13 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1901979&qs=pros-and-cons#reviews) Users value the **scanning efficiency** of Semgrep, benefiting from rapid scans and seamless CI/CD integration. [(12 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301214&qs=pros-and-cons#reviews) Users appreciate the **robust security features** of Semgrep, enabling effective identification and remediation of vulnerabilities effortlessly. [(12 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301279&qs=pros-and-cons#reviews) Users find Semgrep **not user-friendly** , citing a steep learning curve and challenges in initial setup and customization. [(7 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301365&qs=pros-and-cons#reviews) Users note the **limited features** of Semgrep, making categorization and comprehensive analysis more challenging. [(6 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2300785&qs=pros-and-cons#reviews) Users find the **difficult learning** curve for custom rules in Semgrep challenging, impacting new user experiences and efficiency. [(5 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301091&qs=pros-and-cons#reviews) Users face a **lack of guidance** in mastering rule creation and initial setup, impacting effective tool utilization. [(5 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301044&qs=pros-and-cons#reviews) Users find the **learning curve steep** for rule writing, especially for those new to static analysis tools. [(5 mentions)](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301173&qs=pros-and-cons#reviews) ### 5 Pros or Advantages of Semgrep ##### 1. Ease of Use Users value the **ease of use** of Semgrep, praising its intuitive syntax and smooth CI/CD integration. [ See 16 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1901393&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Powerful Rule Engine and Autofix, but Governance at Scale Needs Work" What do you like about Semgrep? Flexible, transparent rule engine with clear YAML syntax and data‑flow patterns, plus an extensive public registry for quick wins and customization. ##### 2. Features Users appreciate the **intuitive pattern-matching syntax** of Semgrep, enabling effective custom rules for various programming languages. [ See 14 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1902218&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Nagaraju A.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Nagaraju A.") NA Nagaraju A. Mid-Market (51-1000 emp.) 5.0/5 "Easy to Use with Great Functional Testing Capabilities" What do you like about Semgrep? I appreciate how Semgrep excels in validating and QA testing capabilities, showing good efficacy in performing these tasks. The ease of use is particu ##### 3. Vulnerability Detection Users appreciate Semgrep's **effective vulnerability detection** , enabling quick identification of security issues with low false positives. [ See 13 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=1901979&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") A Verified User Mid-Market (51-1000 emp.) 5.0/5 "Excellent Tool for Code Quality and Security." What do you like about Semgrep? It is a good tool to identify the issues and security in code which can impact the quality and security. ##### 4. Scanning Efficiency Users value the **scanning efficiency** of Semgrep, benefiting from rapid scans and seamless CI/CD integration. [ See 12 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301214&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Powerful Rule Engine and Autofix, but Governance at Scale Needs Work" What do you like about Semgrep? Flexible, transparent rule engine with clear YAML syntax and data‑flow patterns, plus an extensive public registry for quick wins and customization. ##### 5. Security Users appreciate the **robust security features** of Semgrep, enabling effective identification and remediation of vulnerabilities effortlessly. [ See 12 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301279&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you like about Semgrep? I appreciate using Semgrep for its robust security scanning capabilities, particularly in our code security scans for Azure Data Factory, Azure Databr ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Flexible Rules and GitHub Integration Shine, But Needs Better Product Segmentation" What do you like about Semgrep? Semgrep offers a single platform for SAST and SCA solutions which is good, but the best part is semgrep rules they are so flexible and easy to write t ### 5 Cons or Disadvantages of Semgrep ##### 1. Not User-Friendly Users find Semgrep **not user-friendly** , citing a steep learning curve and challenges in initial setup and customization. [ See 7 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301365&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you dislike about Semgrep? The custom rule syntax took some time to learn and was not intuitive initially. Additionally, sometimes Semgrep misses complex security patterns that ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 5.0/5 "Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed" What do you dislike about Semgrep? Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id ##### 2. Limited Features Users note the **limited features** of Semgrep, making categorization and comprehensive analysis more challenging. [ See 6 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2300785&qs=pros-and-cons#reviews) See Related User Reviews ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Flexible Rules and GitHub Integration Shine, But Needs Better Product Segmentation" What do you dislike about Semgrep? Semgrep doesnt have Product wise segmentation like for organizations with multiple products you will have only projects and have to use labels to cate ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Small-Business (50 or fewer emp.) 4.5/5 "Fast, Accurate, and Seamless Integration with GitHub" What do you dislike about Semgrep? Semgrep is quite narrowly focused, concentrating primarily on security and lacking built-in scanning capabilities for other important areas such as se ##### 3. Difficult Learning Users find the **difficult learning** curve for custom rules in Semgrep challenging, impacting new user experiences and efficiency. [ See 5 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301091&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you dislike about Semgrep? The custom rule syntax took some time to learn and was not intuitive initially. Additionally, sometimes Semgrep misses complex security patterns that ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 5.0/5 "Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed" What do you dislike about Semgrep? Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id ##### 4. Lack of Guidance Users face a **lack of guidance** in mastering rule creation and initial setup, impacting effective tool utilization. [ See 5 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301044&qs=pros-and-cons#reviews) See Related User Reviews ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 4.5/5 "Powerful Rule Engine and Autofix, but Governance at Scale Needs Work" What do you dislike about Semgrep? Governance overhead at scale; maintaining org‑wide rule sets, exceptions, and updates across many repos becomes an operational burden without a dedica ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 5.0/5 "Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed" What do you dislike about Semgrep? Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id ##### 5. Learning Curve Users find the **learning curve steep** for rule writing, especially for those new to static analysis tools. [ See 5 mentions ](https://www.g2.com/products/semgrep/reviews?filters%5Bsentiment_snippet%5D=2301173&qs=pros-and-cons#reviews) See Related User Reviews ![Shreekanth k.](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Shreekanth k.") SK Shreekanth k. Enterprise (\> 1000 emp.) 5.0/5 "Streamlined Code Security with Semgrep" What do you dislike about Semgrep? The custom rule syntax took some time to learn and was not intuitive initially. Additionally, sometimes Semgrep misses complex security patterns that ![Verified User](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User") U Verified User Enterprise (\> 1000 emp.) 5.0/5 "Powerful, Customizable Static Analysis with Fast Scans—Some Learning Curve and Tuning Needed" What do you dislike about Semgrep? Static analysis tools can present certain limitations, such as generating false positives that must be manually reviewed. They may also struggle to id ![Verified User in Insurance](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Insurance") EI Verified User in Insurance Mid-Market (51-1000 emp.) 12/14/2022 "Effective, efficient and eng friendly scanner" 5/5 What do you like best about Semgrep? It's a super customizable, fast and effective tool to have as an inline scanner on the CI/CD pipeline. Review collected by and hosted on G2.com. What do you dislike about Semgrep? Nothing really - support is amazing and while they are still early in developing their product suite, they are super receptive to feedback Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Shifting security left in an Eng friendly way Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Verified User in Information Technology and Services](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Information Technology and Services") AI Verified User in Information Technology and Services Mid-Market (51-1000 emp.) 12/8/2022 "Lightning fast SAST" 4.5/5 What do you like best about Semgrep? It runs super quickly and consistently produces some of the highest-quality and relevant findings I've seen when comparing against other options. Review collected by and hosted on G2.com. What do you dislike about Semgrep? The web app could use some polish, but they're focused on rapid improvements. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Greater visibility into vulnerabilities in our code. Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Verified User in Computer Software](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Computer Software") UC Verified User in Computer Software Small-Business (50 or fewer emp.) 12/8/2022 "Extremely easy to setup and use resulting in immediate value." 5/5 What do you like best about Semgrep? Very easy to set up and the time to value is very short. Review collected by and hosted on G2.com. What do you dislike about Semgrep? I wish the rules had more information on remediation. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Providing static application security analysis with high quality scanning Review collected by and hosted on G2.com. Show More Current UserValidated ReviewerSource: Organic ![Verified User in Information Technology and Services](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Information Technology and Services") UI Verified User in Information Technology and Services Enterprise (\> 1000 emp.) 12/13/2022 "I got a really great experience using Semgrep to fix most vulnerabilities I had with my repo." 4.5/5 What do you like best about Semgrep? 1 - Security inforcment. 2 - Finding common bugs in code. Review collected by and hosted on G2.com. What do you dislike about Semgrep? It was hard for to set it up with my GitHub repo, so things here can be improved for the future. Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? - Like mentioned above the ability to scan for bugs and vulnerabilities in my public repo is one of the benefits. - CI/CD life improvement. - Improving code security. Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Organic ![Verified User in Computer Software](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Computer Software") UC Verified User in Computer Software Enterprise (\> 1000 emp.) 12/8/2022 "Semgrep review" 5/5 What do you like best about Semgrep? I love how customizable semgrep is in terms of identifying static as well as prod sec vulnerabilities Review collected by and hosted on G2.com. What do you dislike about Semgrep? No standard set of error checks for static analysis atleast. Has to be customized Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Detecting prod sec vulnerabilities as well as static errors Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Organic ![Verified User in Financial Services](/assets/icons/anonymous-avatar-purple-4ae1032bdb50ee5682003170c8184aee790d25958bd397abbd384ba52c596a7b.svg "Verified User in Financial Services") AF Verified User in Financial Services Mid-Market (51-1000 emp.) 12/9/2022 "Semgrep suited us very well" 5/5 What do you like best about Semgrep? Easy integration and custom rules. The CLI makes it very easy to run tests locally. Review collected by and hosted on G2.com. What do you dislike about Semgrep? The new UI is a little confusing and the filter addition is a little slow Review collected by and hosted on G2.com. What problems is Semgrep solving and how is that benefiting you? Helped with our SAST program Review collected by and hosted on G2.com. Show More Validated ReviewerSource: Organic ## Top-Rated Alternatives [ ![SonarQube](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "SonarQube") SonarQube 4.4/5(155) ](https://www.g2.com/products/sonarqube/reviews) [ ![Snyk](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "Snyk") Snyk 4.5/5(135) ](https://www.g2.com/products/snyk/reviews) [ ![GitHub](/assets/transparent-ad5be28fbcd25b7b08d2cebe1d957125437fb5407d75ee717965ad22c8808791.gif "GitHub") GitHub 4.7/5(2,397) ](https://www.g2.com/products/github/reviews) [ View All Alternatives ](https://www.g2.com/products/semgrep/competitors/alternatives) ##### Categories on G2 [Vulnerability Scanner](https://www.g2.com/categories/vulnerability-scanner)[Software Composition Analysis](https://www.g2.com/categories/software-composition-analysis)[Static Application Security Testing (SAST)](https://www.g2.com/categories/static-application-security-testing-sast) [Vulnerability Scanner](https://www.g2.com/categories/vulnerability-scanner)[Software Composition Analysis](https://www.g2.com/categories/software-composition-analysis)[Static Application Security Testing (SAST)](https://www.g2.com/categories/static-application-security-testing-sast)[Secure Code Review](https://www.g2.com/categories/secure-code-review)[Dynamic Application Security Testing (DAST)](https://www.g2.com/categories/dynamic-application-security-testing-dast)[Static Code Analysis](https://www.g2.com/categories/static-code-analysis)[AI AppSec Assistants](https://www.g2.com/categories/ai-appsec-assistants)[Interactive Application Security Testing (IAST)](https://www.g2.com/categories/interactive-application-security-testing-iast) [Show MoreShow Less](javascript:void(0);) ##### Explore More [Best MDR software for small business security](https://www.g2.com/discussions/best-mdr-software-for-small-business-security)[Which audience intelligence platforms are worth using for a brand that wants to understand how their target audience compares to competitors' audiences without a full market research engagement?](https://www.g2.com/discussions/which-audience-intelligence-platforms-are-worth-using-for-a-brand-that-wants-to-understand-how-their-target-audience-compares-to-competitors-audiences-without-a-full-market-research-engagement%20)[Which CCM platform is the most user-friendly for startups](https://www.g2.com/discussions/which-ccm-platform-is-the-most-user-friendly-for-startups) [Which cloud-based capital project management systems have the strongest financial controls for a project controls team that needs audit-ready cost reporting without manual reconciliation?](https://www.g2.com/discussions/which-cloud-based-capital-project-management-systems-have-the-strongest-financial-controls-for-a-project-controls-team-that-needs-audit-ready-cost-reporting-without-manual-reconciliation%20)[best compensation management software](https://www.g2.com/discussions/need-help-what-s-the-best-compensation-management-software-solution)[Pros and Cons Details](https://www.g2.com/products/semgrep/reviews?qs=pros-and-cons) [Show MoreShow Less](javascript:void(0);)