{"slug": "semgrep", "name": "Semgrep", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 5, "commenters": 18, "warners": 3, "score": 3.48, "rising": -0.31, "first": "2025-11-21", "latest": "2026-08-27", "why": "For a tool that actually legitimately does this, look at Semgrep.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 8, "compare": 3, "warn": 3}, "spark": [0, 2, 0, 1, 0, 1, 0, 0, 0, 1, 0, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "For a tool that actually legitimately does this, look at Semgrep.", "kind": "", "icon": true, "domain": "semgrep.dev", "github_repo": null, "official_url": "https://semgrep.dev", "pricing": "", "aliases": ["Semgrep"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 791386896, "item_id": 49461681, "url": "https://news.ycombinator.com/item?id=49461681", "by": "pas", "date": "2026-08-27", "stance": "recommend", "quote": "just FYI for anyone who doesn't know about this amazing tool yet:", "excerpt": "just FYI for anyone who doesn't know about this amazing tool yet: https://github.com/semgrep/semgrep", "context": "", "use_case": "Static analysis", "switched_from": "", "story": "Beyond Recall and the Illusion of Competence"}, {"id": 762328928, "item_id": 47645558, "url": "https://news.ycombinator.com/item?id=47645558", "by": "akoboldfrying", "date": "2026-04-04", "stance": "recommend", "quote": "For a tool that actually legitimately does this, look at Semgrep.", "excerpt": "BTW: For a tool that actually legitimately does this, look at Semgrep. Their playground example literally assigns 1 to a variable x, after which searching for \"2\" finds the expression \"1 + x\" in the code: https://semgrep.dev/playground/s/5rKgj", "context": "", "use_case": "", "switched_from": "", "story": "Isseven"}, {"id": 750690865, "item_id": 46918179, "url": "https://news.ycombinator.com/item?id=46918179", "by": "HaiyueZhang", "date": "2026-02-06", "stance": "recommend", "quote": "Semgrep is great for general SAST and I'd recommend using both.", "excerpt": "Hey HN, I built Agent Audit because I kept seeing the same security anti-patterns in AI agent code \u2014 eval() on LLM outputs, subprocess.run(shell=True) with unvalidated tool inputs, system prompts constructed with f-strings. Traditional SAST tools flag some of these, but they don't understand the agent context. What it does: Static analysis for Python agent code (LangChain, CrewAI, AutoGen, etc.) Scans MCP server conf", "context": "", "use_case": "general SAST", "switched_from": "", "story": "Show HN: Agent Audit \u2013 Open-source security scanner for AI agents"}, {"id": 742621681, "item_id": 46413855, "url": "https://news.ycombinator.com/item?id=46413855", "by": "kirumachi", "date": "2025-12-28", "stance": "recommend", "quote": "They are great scanners", "excerpt": "Hi HN, I\u2019m one of the creators of Hokage. We built this because we were tired of the usuall spreadsheet hell that comes with running open-source security tools at any reasonable scale. If you are a small-to-mid-sized team, you likely use tools like Semgrep, Trivy, or Gitleaks. They are great scanners, but they all output different formats, don\u2019t talk to each other, and result in hundreds of duplicate findings that ma", "context": "", "use_case": "SAST scanning", "switched_from": "", "story": "Show HN: Hokage \u2013 Unified Orchestration for Semgrep, Trivy, and Zap"}, {"id": 739315904, "item_id": 46207244, "url": "https://news.ycombinator.com/item?id=46207244", "by": "da_grift_shift", "date": "2025-12-09", "stance": "recommend", "quote": "You'll love taint checking then.", "excerpt": "You'll love taint checking then. https://en.wikipedia.org/wiki/Taint_checking https://semgrep.dev/docs/writing-rules/data-flow/taint-mode/overview", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Gemini Pro 3 imagines the HN front page 10 years from now"}]}], "caveats": [{"label": "", "summary": "", "quotes": [{"id": 779398947, "item_id": 48712434, "url": "https://news.ycombinator.com/item?id=48712434", "by": "SwellJoe", "date": "2026-06-28", "stance": "warn", "quote": "giving models access to the open source semgrep as a tool makes some perform worse and none perform better", "excerpt": "I added GLM 5.2 to my security bug hunting benchmark when it came out, and found it to be a good performer, but not the best open model. The benchmark tests whether models can find bugs Mythos found. The best open models in the initial benchmark were DeepSeek V4 Pro or MiMo 2.5 Pro. But it turned out MiMo got lucky, it's performed worse on almost every test I've done since, while DeepSeek has consistently been among ", "context": "", "use_case": "Static analysis", "switched_from": "", "story": "Semgrep: GLM 5.2 beats Claude in our Cyber Benchmarks"}, {"id": 751602337, "item_id": 46975146, "url": "https://news.ycombinator.com/item?id=46975146", "by": "jfaganel99", "date": "2026-02-11", "stance": "warn", "quote": "Semgrep scanned the same codebase and found 222 issues, 208 of which were false positives, and missed this one entirely.", "excerpt": "Author here. We built a security scanner called Kolega that does semantic analysis instead of pattern matching. To see if it actually worked, we ran it against 45 open source projects and reported what it found through responsible disclosure. 225 vulnerabilities. 41 reviewed by maintainers so far, 37 accepted, 4 rejected. 90% acceptance rate. The bugs weren't exotic. They were things like: if not user_id is not None ", "context": "", "use_case": "", "switched_from": "", "story": "Vulnerabilities in 45 Open Source Projects (vLLM, Langfuse, Phase, NocoDB)"}, {"id": 749665425, "item_id": 46854089, "url": "https://news.ycombinator.com/item?id=46854089", "by": "bumahkib7", "date": "2026-02-02", "stance": "warn", "quote": "tired of waiting 5\u201320 minutes for Semgrep/CodeQL/SonarQube", "excerpt": "I built RMA because I was tired of waiting 5\u201320 minutes for Semgrep/CodeQL/SonarQube on large monorepos. It's a Rust-native CLI that scans ~100k LOC in under 0.5 seconds and now has: - Cross-file taint propagation (input in handler \u2192 util \u2192 sink) - String concatenation & template taint (real SQLi, XSS, command injection, path traversal) - Basic type inference + nullability (null dereference detection) - Typestate/pro", "context": "", "use_case": "", "switched_from": "", "story": "RMA \u2013 Fast Rust monorepo scanner cross-file taint, typestate, <0.5s on 100k LOC"}]}], "who": [], "tags": [], "use_cases": ["static analysis", "security verification", "code rule validation", "static analysis rules", "general sast", "static analysis findings"], "compared": [{"slug": "trivy", "name": "Trivy", "co": 2, "switched_from": 0, "switched_to": 0}, {"slug": "codeql", "name": "CodeQL", "co": 2, "switched_from": 0, "switched_to": 0}], "makers": [{"id": 788656496, "item_id": 49291031, "url": "https://news.ycombinator.com/item?id=49291031", "by": "mdean", "date": "2026-08-13", "stance": "neutral", "quote": "Disclosure: I work at Semgrep", "excerpt": "Disclosure: I work at Semgrep but figure other engineers may find the approach we used interesting.", "context": "works at Semgrep", "use_case": "", "switched_from": "", "story": "SHA pinning GitHub Actions across an organization"}, {"id": 753476432, "item_id": 47092277, "url": "https://news.ycombinator.com/item?id=47092277", "by": "ievans", "date": "2026-02-20", "stance": "neutral", "quote": "As someone who founded a company in the space (Semgrep)", "excerpt": "Not super surprising that Anthropic is shipping a vulnerability detection feature -- OpenAI https://openai.com/index/introducing-aardvark/ and Google announced BigSleep in Nov of 2024. The impact question is really around scale; a few weeks ago Anthropic claimed 500 \"high-severity\" vulnerabilities discovered by Opus 4.6 (https://red.anthropic.com/2026/zero-days/). There's been some skepticism about whether they are t", "context": "founded a company in this space (Semgrep)", "use_case": "", "switched_from": "", "story": "Making frontier cybersecurity capabilities available to defenders"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49446442", "title": "Beyond Recall and the Illusion of Competence", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49297312", "title": "item 49297312", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=49291030", "title": "SHA pinning GitHub Actions across an organization", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48709670", "title": "Semgrep: GLM 5.2 beats Claude in our Cyber Benchmarks", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48526633", "title": "Formal Methods and the Future of Programming", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=48046436", "title": "Mythical Man Month", "mentions": 1}], "sentiment_by_month": {"2025-11": {"compare": 1}, "2025-12": {"recommend": 2, "compare": 1, "neutral": 1}, "2026-01": {"compare": 1}, "2026-02": {"warn": 2, "neutral": 2, "recommend": 1}, "2026-03": {"neutral": 1}, "2026-04": {"recommend": 1, "neutral": 1}, "2026-05": {"neutral": 1}, "2026-06": {"neutral": 1, "warn": 1}, "2026-07": {}, "2026-08": {"neutral": 1, "recommend": 1}, "2026-09": {}, "2026-10": {}}, "quotes": [{"id": 791386896, "item_id": 49461681, "url": "https://news.ycombinator.com/item?id=49461681", "by": "pas", "date": "2026-08-27", "stance": "recommend", "quote": "just FYI for anyone who doesn't know about this amazing tool yet:", "excerpt": "just FYI for anyone who doesn't know about this amazing tool yet: https://github.com/semgrep/semgrep", "context": "", "use_case": "Static analysis", "switched_from": "", "story": "Beyond Recall and the Illusion of Competence"}, {"id": 788757010, "item_id": 49297313, "url": "https://news.ycombinator.com/item?id=49297313", "by": "seantheviking", "date": "2026-08-14", "stance": "neutral", "quote": "we have semgrep, trivy and kerno running in the verfication pipelines", "excerpt": "What turned out as something to solve internal engineering problems at Kerno has now taken a life of it's own. Today we are releasing HarHQ, a way for you to implement, run and visualise your entire AI software factory in under 10 minutes. It's built on top of .HAR, an open-harness to run fleets of agents securely. Chatting with CTO/VP of Engineering from startups to F100, the challenges of factory build out are the ", "context": "", "use_case": "security verification", "switched_from": "", "story": null}, {"id": 779398947, "item_id": 48712434, "url": "https://news.ycombinator.com/item?id=48712434", "by": "SwellJoe", "date": "2026-06-28", "stance": "warn", "quote": "giving models access to the open source semgrep as a tool makes some perform worse and none perform better", "excerpt": "I added GLM 5.2 to my security bug hunting benchmark when it came out, and found it to be a good performer, but not the best open model. The benchmark tests whether models can find bugs Mythos found. The best open models in the initial benchmark were DeepSeek V4 Pro or MiMo 2.5 Pro. But it turned out MiMo got lucky, it's performed worse on almost every test I've done since, while DeepSeek has consistently been among ", "context": "", "use_case": "Static analysis", "switched_from": "", "story": "Semgrep: GLM 5.2 beats Claude in our Cyber Benchmarks"}, {"id": 776461683, "item_id": 48528855, "url": "https://news.ycombinator.com/item?id=48528855", "by": "awinter-py", "date": "2026-06-14", "stance": "neutral", "quote": "haven't tried semgrep but the rules engine seemed intimidating", "excerpt": "See previous kleppmann post https://martin.kleppmann.com/2025/12/08/ai-formal-verification.html, and yes, obviously anything that you can put in the typesystem or the linter, you should weigh doing so. Hopefully we get more ergonomic ways to do this? Like of the tools listed in the post, dafny + iris are the closest to being industrial I think. And amzn S3 has a history of TLA use in-house I think. But we probably ha", "context": "", "use_case": "", "switched_from": "", "story": "Formal Methods and the Future of Programming"}, {"id": 769167681, "item_id": 48072980, "url": "https://news.ycombinator.com/item?id=48072980", "by": "paperpunk", "date": "2026-05-09", "stance": "neutral", "quote": "various rules that can be defined (regex, semgrep, etc.)", "excerpt": "I have a harness for Claude Code \"hooks\" (https://code.claude.com/docs/en/hooks) which in my case execute a Go tool in a separate project which runs changes made by claude through a validator with various rules that can be defined (regex, semgrep, etc.). They can warn claude or they can block changes outright. When I find claude is using tools or approaches that I have replaced with more specific ones, I ask claude t", "context": "", "use_case": "code rule validation", "switched_from": "", "story": "Mythical Man Month"}, {"id": 767518001, "item_id": 47969875, "url": "https://news.ycombinator.com/item?id=47969875", "by": "chaksaray", "date": "2026-04-30", "stance": "neutral", "quote": "Semgrep (41 rules)", "excerpt": "Good question. Honest answer: we haven't manually verified all 28. The tool description injection findings (6 servers, AVE-2026-00002) are the most credible. Patterns like \"IMPORTANT: Always...\" or \"Before calling this tool...\" in a tool description are behavioral instructions regardless of intent that an agent will follow them. Whether that's malicious or just poor documentation is a separate question, but the secur", "context": "", "use_case": "Static analysis rules", "switched_from": "", "story": "We scanned 100 Smithery MCP servers, 22 flagged, here's what we found"}, {"id": 762328928, "item_id": 47645558, "url": "https://news.ycombinator.com/item?id=47645558", "by": "akoboldfrying", "date": "2026-04-04", "stance": "recommend", "quote": "For a tool that actually legitimately does this, look at Semgrep.", "excerpt": "BTW: For a tool that actually legitimately does this, look at Semgrep. Their playground example literally assigns 1 to a variable x, after which searching for \"2\" finds the expression \"1 + x\" in the code: https://semgrep.dev/playground/s/5rKgj", "context": "", "use_case": "", "switched_from": "", "story": "Isseven"}, {"id": 756632800, "item_id": 47289550, "url": "https://news.ycombinator.com/item?id=47289550", "by": "nine_k", "date": "2026-03-07", "stance": "neutral", "quote": "was around for several years, too", "excerpt": "While at it, https://github.com/semgrep/semgrep was around for several years, too.", "context": "", "use_case": "", "switched_from": "", "story": "Ki Editor - an editor that operates on the AST"}, {"id": 754862593, "item_id": 47178912, "url": "https://news.ycombinator.com/item?id=47178912", "by": "jaen", "date": "2026-02-27", "stance": "neutral", "quote": "For modern implementations, there's eg. ast-grep and semgrep:", "excerpt": "This is roughly the same problem as syntactical macros in non-Lisp syntax languages. There needs to be a way to indicate a \"hole\" (metavariable/unquote) in the syntax tree, and depending on the complexity of the language's grammar, that might be somewhat difficult, eg. in C++ having a hole for a type declaration runs into the common ambiguity between declarations (constructor calls) and expressions (regular calls). T", "context": "", "use_case": "", "switched_from": "", "story": "Working on Pharo Smalltalk: BPatterns: Rewrite Engine with Smalltalk Style"}, {"id": 751602337, "item_id": 46975146, "url": "https://news.ycombinator.com/item?id=46975146", "by": "jfaganel99", "date": "2026-02-11", "stance": "warn", "quote": "Semgrep scanned the same codebase and found 222 issues, 208 of which were false positives, and missed this one entirely.", "excerpt": "Author here. We built a security scanner called Kolega that does semantic analysis instead of pattern matching. To see if it actually worked, we ran it against 45 open source projects and reported what it found through responsible disclosure. 225 vulnerabilities. 41 reviewed by maintainers so far, 37 accepted, 4 rejected. 90% acceptance rate. The bugs weren't exotic. They were things like: if not user_id is not None ", "context": "", "use_case": "", "switched_from": "", "story": "Vulnerabilities in 45 Open Source Projects (vLLM, Langfuse, Phase, NocoDB)"}, {"id": 750690865, "item_id": 46918179, "url": "https://news.ycombinator.com/item?id=46918179", "by": "HaiyueZhang", "date": "2026-02-06", "stance": "recommend", "quote": "Semgrep is great for general SAST and I'd recommend using both.", "excerpt": "Hey HN, I built Agent Audit because I kept seeing the same security anti-patterns in AI agent code \u2014 eval() on LLM outputs, subprocess.run(shell=True) with unvalidated tool inputs, system prompts constructed with f-strings. Traditional SAST tools flag some of these, but they don't understand the agent context. What it does: Static analysis for Python agent code (LangChain, CrewAI, AutoGen, etc.) Scans MCP server conf", "context": "", "use_case": "general SAST", "switched_from": "", "story": "Show HN: Agent Audit \u2013 Open-source security scanner for AI agents"}, {"id": 749919441, "item_id": 46869965, "url": "https://news.ycombinator.com/item?id=46869965", "by": "kirumachi", "date": "2026-02-03", "stance": "neutral", "quote": "the full Semgrep message (which often contains the taint trace)", "excerpt": "Great question. Right now (v2.0.1), The TUI is optimized for metadata triage. You see the Rule ID, Severity, the full Semgrep message (which often contains the taint trace), and the File/Line location. The Workflow: 1. I see [High] SQL Injection in db.py:45. 2. If the description is obvious (like a string concatenation), I mark it Confirmed (c) or False Positive (f) right there. 3. For ambiguous cases (like your ORDE", "context": "", "use_case": "static analysis findings", "switched_from": "", "story": "Show HN: Kekkai \u2013 Interactive security triage in the terminal"}, {"id": 749665425, "item_id": 46854089, "url": "https://news.ycombinator.com/item?id=46854089", "by": "bumahkib7", "date": "2026-02-02", "stance": "warn", "quote": "tired of waiting 5\u201320 minutes for Semgrep/CodeQL/SonarQube", "excerpt": "I built RMA because I was tired of waiting 5\u201320 minutes for Semgrep/CodeQL/SonarQube on large monorepos. It's a Rust-native CLI that scans ~100k LOC in under 0.5 seconds and now has: - Cross-file taint propagation (input in handler \u2192 util \u2192 sink) - String concatenation & template taint (real SQLi, XSS, command injection, path traversal) - Basic type inference + nullability (null dereference detection) - Typestate/pro", "context": "", "use_case": "", "switched_from": "", "story": "RMA \u2013 Fast Rust monorepo scanner cross-file taint, typestate, <0.5s on 100k LOC"}, {"id": 748619541, "item_id": 46788721, "url": "https://news.ycombinator.com/item?id=46788721", "by": "singularity99", "date": "2026-01-27", "stance": "compare", "quote": "Unlike static analysis tools (Snyk, Semgrep), CodePhreak actively tests running applications", "excerpt": "Hey HN! I'm excited to share CodePhreak v4.0 \u2013 an open-source autonomous pentesting platform that uses multi-agent AI to find security vulnerabilities in your infrastructure. *The Problem:* Two years ago, I was paying $8K-15K per pentest for my SaaS company. At quarterly testing (required for SOC2), that's $32K-60K/year just to check if we introduced new bugs. For a startup, this was unsustainable. Manual pentesting ", "context": "", "use_case": "", "switched_from": "", "story": null}, {"id": 742621681, "item_id": 46413855, "url": "https://news.ycombinator.com/item?id=46413855", "by": "kirumachi", "date": "2025-12-28", "stance": "recommend", "quote": "They are great scanners", "excerpt": "Hi HN, I\u2019m one of the creators of Hokage. We built this because we were tired of the usuall spreadsheet hell that comes with running open-source security tools at any reasonable scale. If you are a small-to-mid-sized team, you likely use tools like Semgrep, Trivy, or Gitleaks. They are great scanners, but they all output different formats, don\u2019t talk to each other, and result in hundreds of duplicate findings that ma", "context": "", "use_case": "SAST scanning", "switched_from": "", "story": "Show HN: Hokage \u2013 Unified Orchestration for Semgrep, Trivy, and Zap"}, {"id": 740722192, "item_id": 46295137, "url": "https://news.ycombinator.com/item?id=46295137", "by": "tptacek", "date": "2025-12-16", "stance": "neutral", "quote": "Semgrep isn't a formal methods tool", "excerpt": "Called this a little bit: https://fly.io/blog/semgrep-but-for-real-now/ Semgrep isn't a formal methods tool, but it's in the same space of rigor-improving tooling that sound great but in practice are painful to consistently use.", "context": "", "use_case": "", "switched_from": "", "story": "AI will make formal verification go mainstream"}, {"id": 739916865, "item_id": 46244804, "url": "https://news.ycombinator.com/item?id=46244804", "by": "dolftax", "date": "2025-12-12", "stance": "compare", "quote": "Semgrep CE hits 56.97% accuracy vs our 81.21%", "excerpt": "On the OpenSSF CVE Benchmark[1], Semgrep CE hits 56.97% accuracy vs our 81.21%, and nearly 3x higher recall (75.61% vs 26.83%). On when to run it, fair point. Autofix Bot is currently meant for local use (TUI, Claude Code plugin, MCP). We're integrating this pipeline into DeepSource[2], which will have inline comments in pull requests, that fits the QA/pre-merge flow you're describing. That said, if you're using AI a", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Autofix Bot \u2013 Hybrid static analysis and AI code review agent"}, {"id": 739315904, "item_id": 46207244, "url": "https://news.ycombinator.com/item?id=46207244", "by": "da_grift_shift", "date": "2025-12-09", "stance": "recommend", "quote": "You'll love taint checking then.", "excerpt": "You'll love taint checking then. https://en.wikipedia.org/wiki/Taint_checking https://semgrep.dev/docs/writing-rules/data-flow/taint-mode/overview", "context": "", "use_case": "", "switched_from": "", "story": "Show HN: Gemini Pro 3 imagines the HN front page 10 years from now"}, {"id": 736206965, "item_id": 46012935, "url": "https://news.ycombinator.com/item?id=46012935", "by": "ousamzing", "date": "2025-11-21", "stance": "compare", "quote": "just use Semgrep/CodeQL", "excerpt": "Creator here, thanks for checking this out. Code Intel is an experimental platform that combines: -AST parsing (to extract structure, anti-patterns, duplication), - Dependency graph analysis (circular imports, module cohesion), - RAG over the full codebase (ChromaDB + MiniLM embeddings), - Multi-agent LLM reasoning (Security/Performance/Architecture agents via GPT-4). All orchestrated via FastAPI + WebSockets, with a", "context": "", "use_case": "", "switched_from": "", "story": "Code Intel: Multi-agent LLM and AST analysis for Python codebases (Python only)"}]}