Semgrep

The core of Semgrep is an open source static analysis engine that has been on GitHub for years and supports more than 30 languages. What sets it apart is the rule syntax. A rule is a pattern that resembles the source it matches, so writing one does not require picking up a separate query language the way CodeQL does. For an engineering lead this matters more than any feature list. House rules that encode your own past incidents are the checks that actually prevent repeats, and Semgrep is the tool where writing them takes an hour rather than a sprint.

The commercial platform adds cross-file and cross-function analysis, Supply Chain and Secrets, plus the AI layer renamed Multimodal on 19 March 2026. Autofix reached public beta three days earlier, generating draft pull requests with line-level breaking change analysis instead of blind patches. The more interesting release is Guardian, which installs into AI coding agents directly and scans what they produce as they produce it, using the same Code, Supply Chain and Secrets engines. Semgrep was also selected for OpenAI's Trusted Access for Cyber Program, which buys it early access to models with stronger security reasoning. Whether that turns into measurably better detection is worth watching rather than assuming.

The honest limits are about scale and language. Interfile analysis defaults back to single-file mode past 5 GB of memory or a three hour scan, and Ruby, PHP, Swift and Rust get no cross-file coverage at all. Teams on those stacks should test against their actual repository before signing anything. Everyone else, especially a team of ten or fewer that fits inside the free tier, should run it before paying for something more expensive. The gap between what Semgrep gives away and what most vendors charge for is the strongest argument in its favour.