It's super easy to use and doesn't get in the way. The ability to create custom rules and easily ignore existing rules makes this tool standout above any of the other "static analysis" tools I've used to date. Review collected by and hosted on G2.com.

Honestly, there isn't much I dislike. Perhaps having buttons directly interact with the github comments would be nice? Review collected by and hosted on G2.com.

Useful for tracking the open vulnerabilities, repository wise, until they're closed. I find the ability to create custom vulnerability config manually to be very useful, to extend the functionality beyond the vulnerabilities that could be picked up by existing available config templates. Review collected by and hosted on G2.com.

I think the findings could be improved. There's a limit to what static analysis tools can dig out from the code, and probably it's the limitation of technology itself, rather than semgrep. Review collected by and hosted on G2.com.

Very easy to use, no matter which language you are using. Unlike more legacy static code analysis tools, there is no need to spend a lot of time learning rule types and syntaxes; new rules can be spun up and tested very quickly. Also, results are of high quality. Review collected by and hosted on G2.com.

Community support is not as developed as they are pretty new. The breadth of rules and integrations is not as extensive as some other tools. However, this is improving rapidly and the rules that are present have much lesser false positives. Review collected by and hosted on G2.com.

Semgrep's powerful rule language and engine blends usability with flexibility. Developers being able to write their own rules in Semgrep without knowing exactly how Semgrep works has helped us scale our deployment. Review collected by and hosted on G2.com.

Without fine-tuning, Semgrep (like any SAST) can be pretty noisy. I know they've been working on surfacing developer feedback to rule writers and maintainers, but I still wish there was a more scalable way to reduce noise (e.g. rule change suggestions based on where developers report false positives). Review collected by and hosted on G2.com.

We were sold on the idea that Semgrep was Python based and detections were community driven. While still providing us with the ability to write custom detections. Review collected by and hosted on G2.com.

Nothing in particular. If anything, I'd like Semgrep to add GitHub Dependabot / Snyk like features so we can manage more controls around our source code through a single vendor. The latest Supply Chain feature is a new addition. Review collected by and hosted on G2.com.

It is the most efficient and simple to use integration for SAST.

Free, and community-driven

Discussions on Slack channels provide valuable help and insights. Review collected by and hosted on G2.com.

Nothing major. It is evolving in right direction.

But A trial version would be good. Review collected by and hosted on G2.com.

Semgrep makes it really easy to write rules. It's really straightforward and the UI also allows you to easily get feedback on rules as well. The dashboard is also convenient and simple to use. The customer support is also pretty amazing, in that they will help you over a meeting with issues you may have with implementation. Review collected by and hosted on G2.com.

The binary has been buggy in the past, and has required some debugging and patching to get working correctly. However, the Semgrep team was helpful with the entire process. Review collected by and hosted on G2.com.

Super easy to implement and manage. Seamless integration into our CI pipeline, and only gets in the developers' way when it needs to. Reachability testing of depenencies is nice. Review collected by and hosted on G2.com.

Not too much to dislike. The Supply Chain/dependency scanning is new and will need more rules for reachability, but these are gradually being built. Review collected by and hosted on G2.com.

The upsides are that code scanning is very fast, and the ruleset is complete. Rule management on the rule board is also very easy. Integrations and webhooks are a plus. Review collected by and hosted on G2.com.

The downsides are that the number of false positives for some of the rules is enormous due to the lack of taint tracking support for PHP. Improving this ruleset, or adding taint tracking for PHP would be most helpful. Review collected by and hosted on G2.com.

Great analysis of vulnerabilities with ability to review, rank and update status of each incident Review collected by and hosted on G2.com.

It would be great if Semgrep did further static analysis to cover code smells and code coverage, in addition to security. Review collected by and hosted on G2.com.