Application Security Platform

My main use case for Semgrep is that we have DNS records and web addresses for our applications, and we need to scan our web addresses. We use Semgrep to scan our websites' repositories, which are hosted in GitLab. I run a script that scans our repository with Semgrep.

I can provide a specific example of how I use Semgrep in my workflow. I have a script that works with Semgrep repository check functionality to scan our repository and sends the results to the DefectDojo dashboard.

Semgrep has positively impacted my organization by significantly reducing our security blind spots by catching critical vulnerabilities early in the development life cycle before they reach production. It has greatly improved engineering efficiency by providing fast, precise scans with low false positive rates and clear remediation guidance.

We reduced vulnerability triage and review time by over 50%, thanks to Semgrep's low false positive rate and rapid scanning speed. Security issue remediation velocity increased significantly with developers resolving critical findings within days of being flagged in CI/CD pipelines.

The best features Semgrep offers are the ability to scan my repository, send results to DefectDojo, and view everything from the DefectDojo dashboard.

Integrating Semgrep with DefectDojo helps my workflow by centralizing vulnerability management and eliminating manual report parsing. It automates the security life cycle by streamlining tracking, deduplication, and remediation across pipelines.

Regarding Semgrep's AI capabilities, I believe it ensures strong AI governance by combining deterministic static rules with secure data handling practices that protect proprietary secure code. Features like AI-assisted triage and Guardian effectively secure the development pipeline without compromising compliance or data privacy.

Semgrep's AI capabilities deliver high accuracy by combining deterministic static analysis with contextual reasoning, effectively filtering out noise and false positives. The output is consistently reliable for triage and remediation guidance, reducing developer fatigue while maintaining strict adherence to security rules.

Semgrep could be improved by offering more granular configuration options for custom rule tuning and reducing memory overhead during large scale repository scans. Expanding native IDE integrations and providing even more contextual auto-fix suggestions for complex vulnerabilities will further accelerate developer remediation time.

I have been using Semgrep for one year.

Semgrep is stable.

Semgrep excels in scalability, executing lightning-fast scans across large multi-repository code bases without causing significant bottlenecks in CI/CD pipelines.

I haven't used a different solution before Semgrep, but we have used SonarQube. I understand that SonarQube and Semgrep are not the same.

I cannot share specific saving numbers, but I can say Semgrep is useful for us.

I haven't paid for Semgrep right now; I am using free licenses.

Regarding how Semgrep solves my problem about security scanning for repositories, I would rate it a 10, as it is very useful and I use periodic scanning. If I talk about all of the repository scanning issues, I would rate it between eight and 10, with my final decision being nine.

I chose the number nine for Semgrep because we have another repository scanning tool named SonarQube. If I didn't need SonarQube when using Semgrep, I could rate it a 10.

According to my knowledge, I would advise others looking into using Semgrep to start by integrating it incrementally into your CI/CD pipelines using default rule sets. Then gradually customize rules to match your organization's specific security standards and leverage automated triage and DefectDojo integration early on to streamline developer workflows and maintain high engagement with security findings.

My main use case for Semgrep is verifying whether the code existing in our repositories has any embedded secrets.

To give a quick specific example of how I've used Semgrep to find embedded secrets in my repositories, first, we were scanning all the code existing in the repository. Then we created a security gate during our continuous integration process, verifying that the new code is not adding any secrets.

Semgrep has positively impacted my organization by stopping us from storing secrets and credentials in our code base repositories.

During our recent migration from Azure DevOps to GitHub, we found some old certificates embedded inside our desktop application.

The best feature Semgrep offers is that it can scan for any secret being embedded in the code base.

It has been very good at catching these issues before they make it into production. We've found a few secrets in our repositories which shouldn't be stored, and after discovering them, there was a request to delete that part of the code; since then, all of our repositories look clean.

I cannot think of any way Semgrep can be improved.

A clear documentation about how we can make Semgrep ignore some files would be a helpful feature.

I have been using Semgrep for two years.

Semgrep is stable.

We don't have any issues with Semgrep's scalability.

Can't say, didn't use it.

We were using SonarQube before Semgrep.

We decided to switch from SonarQube to Semgrep because we were migrating from Azure DevOps to GitHub as our repository provider where SonarQube was much harder to use. Additionally, GitHub is providing some overlapping features on its own subscriptions with those of SonarQube.

Straightforward

No

I cannot say at this moment if I have seen a return on investment with Semgrep.

I can't remember at this moment if I evaluated other options before choosing Semgrep.

Semgrep is really simple to use and it's very useful. I think it really adds value, especially as a CI gate. I would rate Semgrep a 10 out of 10.

Semgrep serves as an open-source static application security testing tool for my organization. We work under a microservices model with multiple repositories, around eight in total. Whenever we make any code changes, Semgrep scans the whole repository, trying to find security vulnerabilities, bugs, or coding standard violations that might have been missed before peer-to-peer review. It gives us security scanning results and allows us to implement custom rules created in Semgrep, which is integrated with our CI/CD pipeline, such as Jenkins or GitLab. Whenever a pull request is made, Semgrep scans the entire repository and identifies security bugs and code vulnerabilities before any human review.

A quick specific example of how Semgrep helped me catch something important is when we were using Java across multiple repositories while utilizing GCP tokens as our cloud provider. In one of our pipeline files, someone printed a private key token in the console during a pull request review. Semgrep flagged this issue, alerting us that this private key was vulnerable and should never be printed in the console. This was caught before it reached production. Additionally, Semgrep suggested best practices such as encrypting passwords before saving them, which were enhancements we previously overlooked.

Some of the best features Semgrep offers include its capability to integrate with over 30 languages. Our eight repositories consist of Java, Python, Node, and JavaScript. It operates very fast by creating an index to find changes rather than analyzing the entire repository on each commit, thereby scanning large codebases in minutes. Additionally, we can create our own pattern-based rules, which is an essential feature for us.

Setting up custom pattern-based rules is easy, and we use them often for our team's needs. There is no specific coding language or technical skill required; we only need to create a YAML file, which anyone can write and use.

Furthermore, Semgrep can integrate with Integrated Development Environments such as VS Code or IntelliJ. Some of the latest IDEs allow integration, enabling developers to scan the entire codebase directly from their development environment, so it is not only restricted to the CI/CD pipeline.

Semgrep has positively impacted our organization by improving code quality and helping us eliminate vulnerabilities in our code. It allows for faster development since it autonomously reviews repositories and identifies vulnerabilities before a human review, leading to enhanced code quality and automated security testing.

Regarding improvements for Semgrep, I have noticed that it occasionally provides false positive results, although it does not happen consistently. That is the only major improvement I can think of, aside from the fact that the pricing is reasonable. It performs well; I only wish it could fine-tune the rules to reduce false positives.

Regarding any needed improvements, particularly about the UI, I do not have anything to add because it is very simple and easy to use. Anyone can understand it without difficulty, and the pricing seems fair as well. The only issue I see is the sporadic occurrences of false positive results, as previously mentioned.

I have been using Semgrep for around two years.

Semgrep is stable, as far as my experience indicates.

In terms of scalability, I have witnessed Semgrep handle our eight repositories effectively, and throughout our organization, we operate around 150 repositories with a microservices architecture. It effectively scans even very large repositories in just minutes, demonstrating its high scalability.

Concerning customer support, I have not had any use cases that required assistance. However, the documentation is excellent. When I created custom rules, I had some doubts, and the documentation was very helpful, simple, and easy to understand.

Previously, we used SonarQube, but we switched because SonarQube is oriented more towards bug fixing and lacks the focus on security analysis we needed.

The setup is straightforward, requiring no advanced technical knowledge.

We have indeed seen a return on investment with Semgrep, primarily through time savings and improved code quality.

My experience with pricing, setup cost, and licensing has been positive. Initially, we used a free plan for demo and testing purposes, but once we fully integrated it into our company, it has proven to be price-efficient at around $30 a month.

Before choosing Semgrep, I did not evaluate other options aside from SonarQube, which we migrated from to implement Semgrep instead.

Although not directly in the development process, Semgrep has saved substantial time in the review process. For instance, when a developer raises a pull request, Semgrep automatically reviews it before another developer or manager does. This saves a lot of time in reviewing features. Semgrep has detected over 150 vulnerabilities across our eight repositories, and it takes minimal time to scan the full repository, which is one of its best aspects.

I would rate Semgrep a 9 out of 10. I chose a nine out of ten mainly because of the occasional false positive results I mentioned earlier; that is the only thing preventing me from giving it a full score.

Regarding Semgrep's AI capabilities, it serves as a security tool to check for vulnerabilities in code. From my experience, it has successfully identified over 150 security vulnerabilities in our code, and I find it completely reliable in terms of security.

My advice for others considering Semgrep is that if you have large repositories, there are very few tools on the market that can provide security scanning and identify vulnerabilities quickly. Semgrep is one of those tools that performs very efficiently. If security is a concern for you, I recommend trying the free version first; if it proves beneficial for your organization, then make an organizational decision to onboard it.

My main use case is to perform SAST, static application security testing. I have been using it for the last 10 months. Initially, I was planning to use it just for the code review part so that developers can get secure code. However, it can also be integrated in CI/CD pipelines and other tools, which makes it robust.

I deployed Semgrep with my development team in their IDEs, such as VS Code and other notebook tools that my developers use. Semgrep helps to identify code-level issues, such as the possibility of SQL injection, XSS, or hard-coded values. It initially triggers alerts and shows which aspects are not correct and need correction.

First, it is very easy to use. It has customization features that allow me to customize it to find particular types of vulnerabilities that I am looking for. There is scanning efficiency which allows for rapid issue detection early in the development process. The customizable rule engine is the best thing because I can customize it according to my needs.

I can customize my rules according to my needs. The YAML file is easy to write. A person with good basic knowledge of coding can generate custom rules particular to the type of vulnerability they are targeting. Therefore, it is customizable.

The feature is easy to use, saves a lot of time, and is streamlined in nature. That is the best aspect.

It has helped my code review part significantly. It saves around two to three hours per day of going through each line of code to find mistakes and identify issues that are present at the code level. Code review is a tedious task for any security engineer or developer to do, so it helps tremendously while reviewing code.

By avoiding these tedious tasks, my team gets to focus on other important tasks that are required. Sometimes there are urgent tasks that need to be done before code reviews can be completed. The time I save is utilized elsewhere, which effectively benefits my team.

Semgrep can be improved by making it more user-friendly. There are tools in the market, such as Aqua Security, that have features worth utilizing. However, there are some comprehensive scanning capabilities which I feel Semgrep lacks. For code-level review, it is very good.

I have been using Semgrep for around nine to 10 months for detection of security flaws in the code.

It is stable in nature.

It is also good. I can scale it for small to large-scale teams. I can use it with a small number of people or a large-sized team.

Customer support is good because I have not needed much customer support until now, which is very good. I think that is a good part. Their documentation and community are very active, so most of the time when problems occur, I get a solution.

I have used SonarQube. However, the results of Semgrep are much better. I compared them both, so I switched to Semgrep only, and it works very well. I do not have to pay any licensing fee or anything like that. It has been good to work with Semgrep.

I evaluated a tool such as SonarQube, which is in the market and is also open-source. However, the results provided by Semgrep are much more effective and efficient with fewer false positives. The number of true positives is higher, which effectively saves time from checking whether false positives are right or wrong.

The accuracy I would rate at 85 to 90%. Sometimes it gives false positives, but compared to its peers, it is better.

At a team level, I can say that per day I save around two hours, which can result in eight hours a week. Monthly, I save around 30 to 35 hours because of this.

The best case is that it solves a lot of things, and for the vulnerabilities that will arise in the future, I solve them at the initial stage.

It is basically open-source, so the cost to set up is no cost.

If you are looking for an open-source tool that can perform SAST in your environment and you are a technical person with a team that can grasp new technologies in a short period of time, then you can use Semgrep directly to perform SAST and code reviews at the development level. Early detection of security issues and bugs can be fixed.

It streamlines with the governance and compliance of the country where the company operates. It follows GDPR guidelines and EU guidelines. In India, I follow certain guidelines, so it also passes that criteria to go through those guidelines and follow the restrictions and suggestions provided at a national level.

My main use case for Semgrep is as a SAST tool. Since I work with code directly, I use it to scan the code for vulnerabilities and relay information to developers so they can address any issues. This approach ensures I maintain a security focus as a DevOps person, which is crucial.

Semgrep fits into my workflow by allowing me to scan code and ensure there are no breaches before running it in containers.

The best feature of Semgrep is its ability to highlight high priority issues during scanning, making it critical for developers to address these vulnerabilities promptly. This seamless process enhances efficiency and expedites issue resolution within our systems.

I find Semgrep's user-friendliness valuable, allowing me to run scans easily with simple commands, which clearly indicate vulnerabilities and their priority levels, effectively meeting my needs.

When receiving high-priority findings, I act as a DevOps person who incorporates security into my culture by notifying developers about issues I find and urging them to check the code. I advocate that all developers have Semgrep installed on their laptops, ensuring they avoid pushing vulnerable code.

The impact of Semgrep on my organization includes the recommendation I made as an external consultant to incorporate it into projects. It is easy for developers to use and helps monitor our security posture by scanning code before production pushes.

Since implementing Semgrep, I have noticed significant outcomes. For example, I can resolve vulnerabilities that previously took four days in under a day, saving both time and money, thus enhancing our return on investment.

Semgrep needs ongoing improvements, and gathering user feedback will help enhance its effectiveness and provide better solutions globally.

I suggest improving documentation and integrating agentic AI to help users get quicker answers to security problems when scanning.

That first use was in 2022, so that is about four years now, and I continue to use Semgrep on my MacBook, finding it very useful, and I still recommend it to developers.

Semgrep is absolutely stable.

Semgrep's scalability is impressive, being designed as cloud-native and cloud-agnostic, making it easy to integrate and grow within any environment without concern for crashes.

I have not contacted Semgrep's customer service because their documentation usually provides solutions for my inquiries.

I have not used any solution prior to Semgrep.

I find Semgrep's pricing and setup reasonable and recommended its installation for developers to facilitate code scanning and avoid vulnerabilities.

The return on investment from using Semgrep is evident as I save time and money. For example, tasks that previously took days are completed in significantly less time, enabling faster business responses and improved profit margins.

I did not evaluate other options before choosing Semgrep. I found it through an online review and decided to try it based on that.

My advice for others considering Semgrep is to adopt it, as it stands out in the open-source market and shows solid growth. You can trust it based on its innovative developments.

I believe Semgrep will scale effectively with the rise of agentic AI and security needs, leading to broader adoption among companies. Sharing wins at open-source conferences will help demonstrate its potential impact.

I rate this review an 8.

I have used Semgrep more as a testing and a POC tool. So, there is no consistent usage of Semgrep, but I have used the tool multiple times for POC purposes.

As a DevSecOps Security Engineer, my main use case for Semgrep when I do use it for POCs or testing is to deal with SAST, secret scanning, and types of testing, white-box testing, AppSec, and those types of activities. Semgrep is a tool for that. Hence, when we perform POCs and try to understand what it is providing for such different types of scanning, Semgrep turns out to be useful in setting benchmarks.

Even if we mainly use Semgrep for POCs, it has positively impacted our organization. So when we are in the process of identifying new tools or trying to understand how to improve our existing tools, that is where Semgrep comes in handy.

As a result of using Semgrep, it helped us compare tools more effectively. It helped us understand what are the expected must-haves of a tool in this domain. That way, other tools that were not even offering these were easily left out because Semgrep is an open-source tool, and when we are trying to acquire paid tools, it is almost definite they should be offering capabilities at least that an open-source tool is offering.

Semgrep flourishes with the SAST, secret scanning, and Software Composition Analysis types of scanning. That is where Semgrep shines. With SCA, it helps find vulnerabilities, SAST weaknesses, and secrets. These are three existing services that are there in my enterprise, and we have other tools that perform the same. Semgrep, as I said, helps us benchmark that while running POCs.

The Software Composition Analysis is the most valuable feature in Semgrep.

As we use Semgrep for secret scanning, I know it is an open-source tool. Oftentimes, that leads to the refinement of the engine, but oftentimes Semgrep ends up flagging a lot of false positive values. If the name of a variable or any text in the code has the word secret in it, then it flags it as a secret violation or as a secret finding, which may not be the case. It might just be a false positive. It might just be a variable called secret but may not contain a value that is actually secret information.

Of course, there are a bunch of additions and improvements that can be done on Semgrep, but it is an open-source tool. I have at least used the open-source version of it. Of course, that comes only with the CLI. The UI and additional dashboarding and other details would definitely make the tool more user-friendly and more of a candidate to be implemented in an enterprise such as the one that I work for. I have not seen any other areas where Semgrep could be improved, aside from the false positives and dashboarding mentioned earlier.

I give Semgrep a six out of 10 simply because there are other tools that are better than this out there. This is an open-source tool, so it absolutely does the job, but if you were to implement a tool such as this in an enterprise, this would probably not be scalable.

My advice to others looking into using Semgrep is to keep in mind that this is an open-source tool. I gave Semgrep an overall rating of 6.5 out of 10.

I use Semgrep mainly for its software composition analysis capabilities to identify vulnerabilities in dependencies used in our applications. Every time a new feature is developed or a new version of an application is released, it is run against Semgrep using our CI/CD pipelines to identify any new vulnerabilities.

The best part of Semgrep is its ease of integration with CI/CD pipelines and how it is a developer-friendly tool. The interface is really focused on presenting developers what needs to be done, what vulnerabilities have been found, and what packages are affected. Whenever a developer enters the application, they do not need much context because it is really clear what needs to be done based on what the application shows.

Semgrep removes a lot of stress from the product security team since there is now an automated way of checking for vulnerabilities in our software. It has reduced manual work and saved a lot of time since containers no longer need to be manually checked with Semgrep, and we do not even need to check whenever there is a new version. In our automated pipelines, every time there is a new version, the containers get scanned and if something critical or high is detected, we are automatically notified.

Semgrep is scalable and works well across multiple repositories and projects, especially when integrated with CI/CD pipelines as is our case.

The coverage of Semgrep could be a bit better, as there are other tools that are more specialized in other areas of security. Semgrep as an SCA tool is adequate, but if you want to use some other parts of it, you get a high price tag. More advanced dependency analysis features in the SCA part and deeper vulnerability databases would be beneficial.

Semgrep is mostly used because it is considered an industry standard, and many of our customers use Semgrep, so they expect us to use it as well. However, as a tool it is really complex to maintain and to use, and it has a huge price tag.

I have used Semgrep for one year.

There have been no stability issues.

There have been no scalability issues.

Customer support is really good and there is also strong community support.

Trivy was previously used, and the switch to Semgrep was made basically because it is the tool that our customers expect us to use.

The setup was quite straightforward and the pricing model is quite flexible. The setup at the beginning was quick, and our pipelines were managed to be running easy enough and fast enough.

Although there are no metrics available, an improvement in efficiency has been seen since manual labor is not required as much as before. This can be translated to being able to do the same amount of work with less technicians.

Semgrep is considered an alternate solution to other tools.

The first thing you need to do is to integrate Semgrep with your CI/CD pipelines and once they are running, invest time in reading documentation and getting yourself familiar with all of the products offered and all of the capabilities available. Semgrep was found through the peer link navigator that was provided via a LinkedIn message. The overall review rating for this product is 6 out of 10.