Semgrep
Semgrep
A fast, open-source, static analysis tool for finding bugs and enforcing code standards.
Semgrep is an advanced static application security testing (SAST) tool that parses code into Abstract Syntax Trees (AST). This allows developers to write rules that look like the code they are trying to match.
It runs incredibly fast across dozens of languages, integrating effortlessly into CI/CD pipelines to catch security vulnerabilities, logic errors, and anti-patterns before they reach production.
Key Features
- Code-aware pattern matching
- Supports over 30 programming languages
- Seamless CI/CD integration
- Community-driven registry of security rules
- Lightning-fast execution times
Frequently Asked Questions
Yes, Semgrep is open source. It is released under the LGPL-2.1 license.
You can use Semgrep as a free, open-source alternative to SonarQube.
Yes, Semgrep can be self-hosted on your own server or cloud infrastructure.
It is built using Python, JavaScript, C, OCaml, C++.
Similar Open Source Projects
Leave a Review
Share your experience with Semgrep. Your review will be published after moderation.