Skip to main content

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Project description


Semgrep logo

Code scanning at ludicrous speed.

Homebrew PyPI Documentation Join Semgrep community Slack Issues welcome! Star Semgrep on GitHub Docker Pulls Docker Pulls (Old) Follow @semgrep on Twitter


Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows.

Semgrep is semantic grep for code. While running grep "2" would only match the exact string 2, Semgrep would match x = 1; y = x + 1 when searching for 2. Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs.

Note that in security contexts, Semgrep Community Edition will miss many true positives as it can only analyze code within the boundaries of a single function or file. If you want to use Semgrep for security purposes (SAST, SCA, or secrets scanning), the Semgrep AppSec Platform is strongly recommended since it adds the following critical capabilities:

  1. Improved core analysis capabilities (cross-file, cross-function, data-flow reachability) that greatly reduce false positives by 25% and increase detected true positives by 250%
  2. Contextual post-processing of findings with Semgrep Assistant (AI) to further reduce noise by ~20%. In addition, Assistant enriches findings with tailored, step-by-step remediation guidance that humans find actionable >80% of the time.
  3. Customizable policies and seamless integration into developer workflows, giving security teams granular control over where, when, and how different findings are presented to developers (IDE, PR comment, etc.)

The Semgrep AppSec Platform works out-of-the-box with 20000+ proprietary rules across SAST, SCA, and secrets. Pro rules are written and maintained by the Semgrep security research team and are highly accurate, meaning AppSec teams can feel confident bringing findings directly to developers without slowing them down.

Semgrep analyzes code locally on your computer or in your build environment: by default, code is never uploaded. Get started →.

Semgrep CLI image

Language support

Semgrep Code supports 30+ languages, including:

Apex · Bash · C · C++ · C# · Clojure · Dart · Dockerfile · Elixir · HTML · Go · Java · JavaScript · JSX · JSON · Julia · Jsonnet · Kotlin · Lisp · Lua · OCaml · PHP · Python · R · Ruby · Rust · Scala · Scheme · Solidity · Swift · Terraform · TypeScript · TSX · YAML · XML · Generic (ERB, Jinja, etc.)

Semgrep Supply Chain supports 12 languages across 15 package managers, including:

C# (NuGet) · Dart (Pub) · Go (Go modules, go mod) · Java (Gradle, Maven) · Javascript/Typescript (npm, Yarn, Yarn 2, Yarn 3, pnpm) · Kotlin (Gradle, Maven) · PHP (Composer) · Python (pip, pip-tool, Pipenv, Poetry) · Ruby (RubyGems) · Rust (Cargo) · Scala (Maven) · Swift (SwiftPM)

For more information, see Supported languages.

Getting started 🚀

  1. From the Semgrep AppSec Platform
  2. From the CLI

For new users, we recommend starting with the Semgrep AppSec Platform because it provides a visual interface, a demo project, result triaging and exploration workflows, and makes setup in CI/CD fast. Scans are still local and code isn't uploaded. Alternatively, you can also start with the CLI and navigate the terminal output to run one-off searches.

Option 1: Getting started from the Semgrep Appsec Platform (Recommended)

Semgrep platform image

  1. Register on semgrep.dev

  2. Explore the demo findings to learn how Semgrep works

  3. Scan your project by navigating to Projects > Scan New Project > Run scan in CI

  4. Select your version control system and follow the onboarding steps to add your project. After this setup, Semgrep will scan your project after every pull request.

  5. [Optional] If you want to run Semgrep locally, follow the steps in the CLI section.

Notes:

If there are any issues, please ask for help in the Semgrep Slack.

Option 2: Getting started from the CLI

  1. Install Semgrep CLI
# For macOS
$ brew install semgrep

# For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep

# To try Semgrep without installation run via Docker
$ docker run -it -v "${PWD}:/src" semgrep/semgrep semgrep login
$ docker run -e SEMGREP_APP_TOKEN=<TOKEN> --rm -v "${PWD}:/src" semgrep/semgrep semgrep ci
  1. Run semgrep login to create your account and login to Semgrep.

Logging into Semgrep gets you access to:

  1. Go to your app's root directory and run semgrep ci. This will scan your project to check for vulnerabilities in your source code and its dependencies.

  2. Try writing your own query interactively with -e. For example, a check for Python == where the left and right hand sides are the same (potentially a bug): $ semgrep -e '$X == $X' --lang=py path/to/src

Semgrep Ecosystem

The Semgrep ecosystem includes the following:

  • Semgrep Community Edition - The open-source program analysis engine at the heart of everything. Suitable for ad-hoc use cases with a high tolerance for false positives - think consultants, security auditors, or pentesters.

  • Semgrep AppSec Platform - Easily orchestrate and scale SAST, SCA, and Secrets scanning across an organization, with no risk of overwhelming developers. Customize which findings developers see, where they see them, and integrate with CI providers like GitHub, GitLab, CircleCI, and more. Includes both free and paid tiers.

    • Semgrep Code (SAST) - Make real progress on your vulnerability backlog with SAST that minimizes noise and empowers developers to quickly fix issues on their own, even if they have no security knowledge. Easy to deploy secure guardrails and tailored, step-by-step remediation guidance mean developers actually fix issues since they don't feel slowed down.

    • Semgrep Supply Chain (SSC) - A high-signal dependency scanner that detects reachable vulnerabilities in open source third-party libraries and functions.

    • Semgrep Secrets (Secrets scanning) - Secrets detection that uses semantic analysis, improved entropy analysis, and validation to accurately surface sensitive credentials in the developer workflow.

    • Semgrep Assistant (AI) - Assistant is an AI-powered AppSec engineer that helps both developers and AppSec teams prioritize, triage, and remediate Semgrep findings at scale. Humans agree with Assistant auto-triage decisions 97% of the time, and rate generated remediation guidance as helpful 80% of the time. For an overview of how Assistant works, read this overview.

Additional resources:

  • Semgrep Playground - An online interactive tool for writing and sharing rules.
  • Semgrep Registry - 2,000+ community-driven rules covering security, correctness, and dependency vulnerabilities.

Join hundreds of thousands of other developers and security engineers already using Semgrep at companies like GitLab, Dropbox, Slack, Figma, Shopify, HashiCorp, Snowflake, and Trail of Bits.

Semgrep is developed and commercially supported by Semgrep, Inc., a software security company.

Semgrep Rules

Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python print() statements.

Run it online in Semgrep’s Playground by clicking here.

Semgrep rule example for finding Python print() statements

Examples

Visit Docs > Rule examples for use cases and ideas.

Use case Semgrep rule
Ban dangerous APIs Prevent use of exec
Search routes and authentication Extract Spring routes
Enforce the use secure defaults Securely set Flask cookies
Tainted data flowing into sinks ExpressJS dataflow into sandbox.run
Enforce project best-practices Use assertEqual for == checks, Always check subprocess calls
Codify project-specific knowledge Verify transactions before making them
Audit security hotspots Finding XSS in Apache Airflow, Hardcoded credentials
Audit configuration files Find S3 ARN uses
Migrate from deprecated APIs DES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs
Apply automatic fixes Use listenAndServeTLS

Extensions

Visit Docs > Extensions to learn about using Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!

Documentation

Browse the full Semgrep documentation on the website. If you’re new to Semgrep, check out Docs > Getting started or the interactive tutorial.

Metrics

Using remote configuration from the Registry (like --config=p/ci) reports pseudonymous rule metrics to semgrep.dev.

When using configs from local files (like --config=xyz.yml), metrics are sent only when the user is logged in.

To disable Registry rule metrics, use --metrics=off.

The Semgrep privacy policy describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.

More

Upgrading

To upgrade, run the command below associated with how you installed Semgrep:

# Using Homebrew
$ brew upgrade semgrep

# Using pip
$ python3 -m pip install --upgrade semgrep

# Using Docker
$ docker pull semgrep/semgrep:latest

Project details


Release history Release notifications | RSS feed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

semgrep-1.127.1.tar.gz (42.1 MB view details)

Uploaded Source

Built Distributions

semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-win_amd64.whl (42.7 MB view details)

Uploaded CPython 3.10CPython 3.11CPython 3.9Python 3.10Python 3.11Python 3.9Windows x86-64

semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-musllinux_1_0_x86_64.manylinux2014_x86_64.whl (48.5 MB view details)

Uploaded CPython 3.10CPython 3.11CPython 3.9Python 3.10Python 3.11Python 3.9musllinux: musl 1.0+ x86-64

semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-musllinux_1_0_aarch64.manylinux2014_aarch64.whl (52.3 MB view details)

Uploaded CPython 3.10CPython 3.11CPython 3.9Python 3.10Python 3.11Python 3.9musllinux: musl 1.0+ ARM64

semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-macosx_11_0_arm64.whl (40.0 MB view details)

Uploaded CPython 3.10CPython 3.11CPython 3.9Python 3.10Python 3.11Python 3.9macOS 11.0+ ARM64

semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-macosx_10_14_x86_64.whl (35.0 MB view details)

Uploaded CPython 3.10CPython 3.11CPython 3.9Python 3.10Python 3.11Python 3.9macOS 10.14+ x86-64

File details

Details for the file semgrep-1.127.1.tar.gz.

File metadata

  • Download URL: semgrep-1.127.1.tar.gz
  • Upload date:
  • Size: 42.1 MB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.1.0 CPython/3.12.9

File hashes

Hashes for semgrep-1.127.1.tar.gz
Algorithm Hash digest
SHA256 f4daaf378ce1f698b1babd8d9973e5da1e39322aeb63e8ee01f30c4861806a5a
MD5 949c6fa0863e97808b15d0194c35a39a
BLAKE2b-256 092ae29ffe4e27faa3dcb7819ef90a884df543297ca17dfc519258fe49e1bd5e

See more details on using hashes here.

File details

Details for the file semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-win_amd64.whl.

File metadata

File hashes

Hashes for semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-win_amd64.whl
Algorithm Hash digest
SHA256 80f3b1ef844b192970780ac7e341586f756216f464ee40a1e083baaaaf5d80b7
MD5 8d0835f304baf4cc57e1d5f293bcc86a
BLAKE2b-256 03b681220ad16da7cfab1c7f3c53c810528d82f0441c8efd207d322d7aa1529f

See more details on using hashes here.

File details

Details for the file semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-musllinux_1_0_x86_64.manylinux2014_x86_64.whl.

File metadata

File hashes

Hashes for semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-musllinux_1_0_x86_64.manylinux2014_x86_64.whl
Algorithm Hash digest
SHA256 068fbd6e35b684356d14e7bb759b40d31d43cd9bfe88e4d209e18f91fda7ff8b
MD5 3e758ea402554388e249ae725479f0f4
BLAKE2b-256 3b820f834b8315d0ae75fe53e45e7ce6e411f01d0119b0feb22f5a681f46760c

See more details on using hashes here.

File details

Details for the file semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-musllinux_1_0_aarch64.manylinux2014_aarch64.whl.

File metadata

File hashes

Hashes for semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-musllinux_1_0_aarch64.manylinux2014_aarch64.whl
Algorithm Hash digest
SHA256 190bac5209ba14ce3c52e41ebaaa7d1e7282d826eebc0db4635d88d45d30d1e3
MD5 4ae3c98c5c5d5a4ca04ac9a7821668be
BLAKE2b-256 12c196f9f452700747067d1bc31a254c7ee137a3d62c275dae8ed167c88b726a

See more details on using hashes here.

File details

Details for the file semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-macosx_11_0_arm64.whl.

File metadata

File hashes

Hashes for semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-macosx_11_0_arm64.whl
Algorithm Hash digest
SHA256 7e277f4a0cc23396341e6ac7d111703b7dffe093776798919cd05c564350bf5d
MD5 8f73f40abf3db73cf6f01d2b0999023f
BLAKE2b-256 8b59a24bc03890969a44a01aeee58492b8f66a9d0d7742311f6b01ceb835ed60

See more details on using hashes here.

File details

Details for the file semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-macosx_10_14_x86_64.whl.

File metadata

File hashes

Hashes for semgrep-1.127.1-cp39.cp310.cp311.py39.py310.py311-none-macosx_10_14_x86_64.whl
Algorithm Hash digest
SHA256 891701fa9914c600219772f30cef849c2ec6d43d2ef531c518f880702e8fa63d
MD5 fdd8c58d1ceb9b0aadf1ebf026f70770
BLAKE2b-256 b06ae9b09cb9a8e220c465ee8295b69c0c4c52030768d43209d4e8c633f7144b

See more details on using hashes here.

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Pingdom Monitoring Sentry Error logging StatusPage Status page