Semgrep App Security Platform

Market position

Described as one of the two most prominent SAST engines in modern application security alongside GitHub's CodeQL, representing a fast pattern-matching philosophy versus CodeQL's deeper semantic analysis; on the OWASP benchmark cited, Semgrep scores an F1 of 69.4% against CodeQL's 74.4%, while being faster, easier to extend with custom rules and CI-system agnostic, leading some teams to run both [4]. Semgrep positions itself against legacy AppSec vendors Checkmarx and Snyk [0][1].

Rules written in YAML that resemble the scanned source code lower the barrier to custom rule authoring compared with CodeQL's QL/Datalog language; scans are faster and work across all CI systems rather than being GitHub-centric; and the platform layers AI triage and remediation on deterministic static analysis, claiming reduced false positives and reusable triage decisions [0][1][4].

Technology

AST-based pattern matching over 35+ languages via tree-sitter parsers, normalized into a generic AST; YAML rules with metavariables, ellipsis operators and pattern combinators; taint-mode dataflow analysis with sources, sinks, sanitizers and propagators; a Pro Engine adding cross-function and cross-file dataflow; reachability analysis for open-source dependencies; semantic plus entropy analysis and live validation for secrets; and AI layers for multimodal detection, automated triage, remediation suggestions and reusable triage "memories" that suppress repeat false positives [0][1][4]. Acknowledged structural limits of the pattern-based approach include no pointer or shape analysis, no soundness guarantees, no path sensitivity, and limited tracking of taint through complex data structures [4].

Go-to-market

Product-led entry via the free open-source CLI and Community Edition and a self-service free trial, converting to paid platform subscriptions sold through demos, a partner program and competitive-displacement offers such as the "New Shift Program" aimed at migrating users off Checkmarx or Snyk; supporting content includes docs, blog, ROI calculator, case studies, webinars, events and a community Slack [0][1][4].

Software engineers and developers, application security teams, and CISOs at engineering-driven organizations; the site highlights fintech and SaaS/cloud verticals and cites users at Vanta, Thinkific and Acrisure [0][1][4].

Geography

Headquartered in San Francisco, California, United States [3].

History

Founded in 2017 as r2c and subsequently renamed Semgrep, Inc., the company grew an open-source AST pattern-matching CLI into a commercial AppSec platform spanning SAST, supply chain and secrets scanning [3][4]. In December 2024 it moved several previously open features behind a commercial license, and in January 2025 more than ten competing vendors forked Semgrep Community Edition into a project called Opengrep [4]. Subsequent milestones reported by press aggregators include recognition on Inc.'s 2025 Best in Business list (December 2025), the launch of Multimodal (March 2026) and the hiring of Cathy Polinsky as Co-CTO and VP of Engineering (May 2026) [3].

Risks & controversies

In December 2024 Semgrep placed several previously open features behind a commercial license; although the core LGPL engine license was unchanged, the move prompted 10+ competing vendors to fork Semgrep Community Edition into "Opengrep" in January 2025 and introduced uncertainty about the company's open-source trajectory [4]. Comparative benchmarking also places Semgrep below CodeQL on OWASP benchmark F1 score, and the pattern-matching architecture has acknowledged analytical limits [4]. Many quantitative performance claims are vendor-published rather than independently verified [0][1].