One of the things that I love most about Semgrep is how easy it is to use. As a static analysis tool, it has a reputation for being intimidating or difficult to integrate into existing workflows. But with Semgrep, developers don't have to worry about that at all. It seamlessly integrates with many popular code editors, version control systems, and continuous integration tools. This means that it's a breeze to set up and start using to detect potential security vulnerabilities, performance issues, and other code quality problems.

But what's really cool about Semgrep is how it feels like a tool that's designed with developers in mind. The pre-built rules are incredibly comprehensive and cover a wide range of potential issues. But if you need to customize them for your project, it's easy to do so. And if you ever get stuck, the community is always there to help you out.

All in all, Semgrep is a powerful tool that can help developers improve the quality of their code. But more importantly, it feels like a tool that was designed to make our lives easier. And who doesn't love that? Review collected by and hosted on G2.com.

As with any tool, Semgrep has some potential downsides to consider. Here are a few:

Learning curve: While Semgrep is generally considered to be user-friendly and easy to use, there is still a learning curve to using any new tool. Some developers may need to spend some time getting familiar with Semgrep's syntax and how to write and modify rules.

False positives/negatives: Like any static analysis tool, Semgrep can generate false positives (i.e., flagging code as problematic when it's not) or false negatives (i.e., failing to flag problematic code). This can be frustrating and may require some additional time and effort to sort out.

Resource-intensive: Depending on the size of your codebase, running Semgrep can be resource-intensive and may slow down your development process. It's important to consider this when integrating Semgrep into your workflow and ensure that your hardware and infrastructure can handle it.

Overall, these potential downsides are relatively minor compared to the benefits that Semgrep can provide. However, it's important to consider these factors when deciding whether or not Semgrep is the right tool for your project. Review collected by and hosted on G2.com.

-Installation is pretty straightforward

-Supports almost all programming languages

-Scans are relatively faster than other static code analysis tool

-In certain cases, I have noticed results/findings from Semgrep were more accurate Review collected by and hosted on G2.com.

-There were quite a few false positives as well

-Other tools such as Sonarqube has more features and provides thorough reports

-Troubleshooting can be difficult Review collected by and hosted on G2.com.

Semgrep helped us in no time narrowing down important vulnerabilities and focusing on what matters thanks to Semgrep Supply Chain.

It is the product with the best ROI I would recommend to add to your SSDLC. it fast, extendable and customizable, with a handy CLI. Review collected by and hosted on G2.com.

Less advanced Bitbucket / Jira integration compared to GitHub but catching up fast! Review collected by and hosted on G2.com.

Semgrep is an easy-to-use and highly customizable static code analysis tool. Its intuitive interface and flexible rules library make running scans on any codebase effortless, big or small. With its active community of contributors and open-source nature, Semgrep is an essential tool for developers looking to enhance code quality and security quickly and efficiently. Review collected by and hosted on G2.com.

I have not encountered any major issues while using the product so far. During onboarding, I experienced some minor UI issues, but they did not significantly impact my overall experience. Review collected by and hosted on G2.com.

context aware scanning that allows a security engineer to see true metrics on vulnerabilities in the code. Its offering of IaC shows how much context aware it can be with its custom data flows. Review collected by and hosted on G2.com.

It's hard to name anything in particular, but the one thing that is challenging is to get onboarded with this. There is definitely a learning curve to get started with writing your own rules. Review collected by and hosted on G2.com.

The Semgrep supply chain is a boon for application and product security teams. Backed by the already solid Semgrep engine, it can quickly surface vulnerabilities that are *actually* vulnerabilities and materially improves our security and risk management. It feels like it gave me new superpowers. I would recommend this to any security team, along with the base product. Most importantly, the r2c engineers and support team are first-rate. They are incredibly supportive and responsive, and I felt like their most important customer every step of the way. Review collected by and hosted on G2.com.

There are very few downsides I can think of, but one that comes to mind is the ability to extend or templatize existing rules. The base rules and rulesets are good but may produce false positives without customization. I would love the ability for Semgrep to offer a way to further customize rules and layer on specificity that increase accuracy. Review collected by and hosted on G2.com.

The customization helps teams shift left. I can create my own rules to avoid false positives and decide which rules block vs. comment vs. just monitor. This helps keep the noise down, makes it easy for software developers to fix findings immediately, and block vulnerabilities from production. Review collected by and hosted on G2.com.

I can't run different rulesets at different times. I'd like the ability to run a certain subset of rules in a CI/CD pipeline to block from deploying high-fidelity findings from production; while also running a larger set of best practices and lower-fidelity rules in a separate pipeline to help us with training and fixing less concerning issues that are more complex as tech debt. Review collected by and hosted on G2.com.

Custom rules and being able to fork + modify the existing rules make Semgrep a lot more valuable as a SAST tool. For certain rules, a couple of additional "pattern-not"s have reduced our false-positive rate by as much as 30%. That kind of thing is easy in Semgrep and pretty much impossible with all other SAST tools I've used. Many other providers claim that you don't need that capability with their tools; because they have teams of people who already improve their false-positive rate. In reality, I've found Semgrep's approach works much better to cut down on spurious results. Review collected by and hosted on G2.com.

Semgrep App is still noticeably immature. There are many minor bugs around the editor, creating private rules, and the rule board. I haven't found any without some sort of workaround thus far, and R2C's support team is extremely responsive. On balance, the upsides of centralizing your rule management and having a single pane of glass to view all findings are worth the sometimes buggy UI and lacking features (such as the inability to delete rules published via the CLI). Review collected by and hosted on G2.com.

Easy to add custom rules (e.g. by using the online rule editor). Also, Semgrep App has some nice, convenient features (like private rule repository). Review collected by and hosted on G2.com.

Most of the paid Semgrep features can be worked around with the open source version (e.g. using a private git repository to store private rules), so I am not 100% sure the Semgrep Team license and the whole Semgrep App are mature enough to justify the price tag.

Also, we ran into many bugs since we started to roll it out within the organization. The good news is that Semgrep Support is responsive (although with 9 hours time zone diff); the bad news is that I require their help constantly since I find 1-2 new bugs every week. Review collected by and hosted on G2.com.

Semgrep is quick and allows us to write additional rules very easily.

This makes it very effective, and there is support for a lot of languages. The dashboard is user friendly and its easy to look for findings reported. Review collected by and hosted on G2.com.

Semgrep does not show co-relation with multiple files. For example if an input is not filtered and is reflected on another page where it would get rendered it would be difficult to identify inSemgrep.

Finding a way to have co-relation between multiple files would be great to have. Review collected by and hosted on G2.com.