Semgrep
No written verdict yet. Here is what commenters said.
Why people recommend it
“just FYI for anyone who doesn't know about this amazing tool yet:”
“For a tool that actually legitimately does this, look at Semgrep.”
Show 3 more
“Semgrep is great for general SAST and I'd recommend using both.”
“They are great scanners”
“You'll love taint checking then.”
Caveats and dissent
“giving models access to the open source semgrep as a tool makes some perform worse and none perform better”
“Semgrep scanned the same codebase and found 222 issues, 208 of which were false positives, and missed this one entirely.”
Show 1 more
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube”
Often compared with
From the makers not counted in the ranking
“Disclosure: I work at Semgrep”
“As someone who founded a company in the space (Semgrep)”
Threads where it came up
- Beyond Recall and the Illusion of Competence 1 mention
- item 49297312 1 mention
- SHA pinning GitHub Actions across an organization 1 mention
- Semgrep: GLM 5.2 beats Claude in our Cyber Benchmarks 1 mention
- Formal Methods and the Future of Programming 1 mention
- Mythical Man Month 1 mention
Data: semgrep.json. Quotes are verbatim; the verdict and theme labels are written by a model from these comments, and every clause links to its sources.
All comments 19
“just FYI for anyone who doesn't know about this amazing tool yet:”
“we have semgrep, trivy and kerno running in the verfication pipelines”
“giving models access to the open source semgrep as a tool makes some perform worse and none perform better”
“haven't tried semgrep but the rules engine seemed intimidating”
“various rules that can be defined (regex, semgrep, etc.)”
“Semgrep (41 rules)”
“For a tool that actually legitimately does this, look at Semgrep.”
“was around for several years, too”
“For modern implementations, there's eg. ast-grep and semgrep:”
“Semgrep scanned the same codebase and found 222 issues, 208 of which were false positives, and missed this one entirely.”
“Semgrep is great for general SAST and I'd recommend using both.”
“the full Semgrep message (which often contains the taint trace)”
“tired of waiting 5–20 minutes for Semgrep/CodeQL/SonarQube”
“Unlike static analysis tools (Snyk, Semgrep), CodePhreak actively tests running applications”
“They are great scanners”
“Semgrep isn't a formal methods tool”
“Semgrep CE hits 56.97% accuracy vs our 81.21%”
“You'll love taint checking then.”
“just use Semgrep/CodeQL”