Semgrep is an open-source static analysis engine that scans code for security vulnerabilities, bugs, and anti-patterns using lightweight YAML-based rules. Unlike traditional SAST tools that require complex configuration, Semgrep rules are readable and writable by any developer.
The engine runs 10-20x faster than legacy SAST tools because it uses a pattern-matching approach rather than full program compilation. It supports over 30 programming languages and produces results with low false positive rates.
The Semgrep AppSec Platform extends the open-source engine with Semgrep Code (SAST with proprietary pro rules), Semgrep Supply Chain (SCA for dependency vulnerabilities), and Semgrep Secrets (leaked credentials detection). AI-powered triage helps prioritize findings by exploitability.
A community-driven rule registry provides over 3,000 pre-built rules covering OWASP Top 10, CWE, and framework-specific patterns. Teams can also write custom rules tailored to their codebase conventions and internal security requirements.