Semgrep

LGPL-2.1 SAST engine; Free Edition caps repos/contributors

DevOps / Infrastructure · LGPL-2.1 · 17.1k

Reviewed 2026-09-09 · last push 2026-10-19 · repo checked 2026-10-19

What's Good

LGPL-2.1 engine. Run locally/in your CI so source can stay off Semgrep servers. Huge rule ecosystem, custom patterns, IDE plugins. Free Edition is a real $0 SaaS start (Code + Supply Chain) with Pro engine/rules called out on pricing — up to 10 private repos and 10 contributors per semgrep.dev/pricing.

The Catch

Vs Trivy/Gitleaks (scanners): Semgrep is SAST/SCA-shaped AppSec, not container CVE inventory or git-history secret regex alone. Teams starts ~$30/contributor/mo per product; Secrets is a separate SKU. Free Edition caps contributors/repos — OSS CLI without the SaaS seat is the uncapped escape hatch.

Verdict

LGPL SAST. Free forever CLI; Free Edition SaaS for small teams; Teams when AppSec wants the paid platform.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/semgrep.svg)](https://stackgems.com/gems/semgrep)

HTML

<a href="https://stackgems.com/gems/semgrep"><img src="https://stackgems.com/badge/semgrep.svg" alt="Semgrep reviewed on Stack Gems" height="20"></a>

DevOps →

Related