# Semgrep

> LGPL-2.1 SAST engine; Free Edition caps repos/contributors

**Category:** DevOps  
**Pricing:** open-source  
**URL:** https://semgrep.dev  
**GitHub:** https://github.com/semgrep/semgrep  
**Added:** 2026-09-09

---

## The Hook

Semgrep is pattern-based static analysis when you want fast custom rules and a real $0 Free Edition to start.

## What's Good

LGPL-2.1 engine. Run locally/in your CI so source can stay off Semgrep servers. Huge rule ecosystem, custom patterns, IDE plugins. Free Edition is a real $0 SaaS start (Code + Supply Chain) with Pro engine/rules called out on pricing — up to 10 private repos and 10 contributors per semgrep.dev/pricing.

## The Catch

Vs Trivy/Gitleaks (scanners): Semgrep is SAST/SCA-shaped AppSec, not container CVE inventory or git-history secret regex alone. Teams starts ~$30/contributor/mo per product; Secrets is a separate SKU. Free Edition caps contributors/repos — OSS CLI without the SaaS seat is the uncapped escape hatch.

## Verdict

LGPL SAST. Free forever CLI; Free Edition SaaS for small teams; Teams when AppSec wants the paid platform.