Although not directly in the development process, Semgrep has saved substantial time in the review process. For instance, when a developer raises a pull request, Semgrep automatically reviews it before another developer or manager does. This saves a lot of time in reviewing features. Semgrep has detected over 150 vulnerabilities across our eight repositories, and it takes minimal time to scan the full repository, which is one of its best aspects. I would rate Semgrep a 9 out of 10. I chose a nine out of ten mainly because of the occasional false positive results I mentioned earlier; that is the only thing preventing me from giving it a full score. Regarding Semgrep's AI capabilities, it serves as a security tool to check for vulnerabilities in code. From my experience, it has successfully identified over 150 security vulnerabilities in our code, and I find it completely reliable in terms of security. My advice for others considering Semgrep is that if you have large repositories, there are very few tools on the market that can provide security scanning and identify vulnerabilities quickly. Semgrep is one of those tools that performs very efficiently. If security is a concern for you, I recommend trying the free version first; if it proves beneficial for your organization, then make an organizational decision to onboard it.
It streamlines with the governance and compliance of the country where the company operates. It follows GDPR guidelines and EU guidelines. In India, I follow certain guidelines, so it also passes that criteria to go through those guidelines and follow the restrictions and suggestions provided at a national level.
My advice for others considering Semgrep is to adopt it, as it stands out in the open-source market and shows solid growth. You can trust it based on its innovative developments. I believe Semgrep will scale effectively with the rise of agentic AI and security needs, leading to broader adoption among companies. Sharing wins at open-source conferences will help demonstrate its potential impact. I rate this review an 8.
The first thing you need to do is to integrate Semgrep with your CI/CD pipelines and once they are running, invest time in reading documentation and getting yourself familiar with all of the products offered and all of the capabilities available. Semgrep was found through the peer link navigator that was provided via a LinkedIn message. The overall review rating for this product is 6 out of 10.
You should primarily focus on what your use case is and why you are moving out. If you are moving out just from the perspective of cost, I do not think Semgrep is the best solution for you. However, if you are looking for value for investment and want to have the complete visibility into your code with less noise, if you are not just looking for a SAST but are really looking for actionable results and want to improve your developer experience and feedback, then you should go for Semgrep. In my organization, it is not only me who selects the solution; I bring in developers from junior and senior levels of all experience and ask them to take a hands-on experience and give me feedback. If you want to improve the developer experience, then go for Semgrep. Compared to other competitors in the market, the AI-backed capability is the biggest strength of Semgrep. The seamless integration is another major advantage because I have done it for a few other solutions, some of which are extremely difficult and some are okay, but the Semgrep integration with the code repository was the smoothest. The quality of results and reduction in noise are also strengths compared to other competitors. Semgrep also has a great strength in the number of rule sets they have compared to all other vendors. While all other vendors have very limited numbers even though they claim to be enterprise, their community edition itself has close to 4,000 rules and the enterprise edition has around 20,000 rules. That is a really strong advantage. As for limitations, I would say that Semgrep currently just supports Jira and Slack for integrations. They should expand to different integrations like ServiceNow and other CNAP and CSPM solutions where all results can be brought into one place. I would rate this review an 8 out of 10.
Semgrep is an advanced static analysis tool designed to identify vulnerabilities and enforce coding standards, catering primarily to professionals with a focus on enhancing code security and quality.Engineered for software development environments, Semgrep delivers efficient security feedback with minimal setup. By offering a rich collection of rule sets, it allows customization and integration into CI/CD pipelines, supporting continuous code examination. Semgrep not only uncovers hidden...
Although not directly in the development process, Semgrep has saved substantial time in the review process. For instance, when a developer raises a pull request, Semgrep automatically reviews it before another developer or manager does. This saves a lot of time in reviewing features. Semgrep has detected over 150 vulnerabilities across our eight repositories, and it takes minimal time to scan the full repository, which is one of its best aspects. I would rate Semgrep a 9 out of 10. I chose a nine out of ten mainly because of the occasional false positive results I mentioned earlier; that is the only thing preventing me from giving it a full score. Regarding Semgrep's AI capabilities, it serves as a security tool to check for vulnerabilities in code. From my experience, it has successfully identified over 150 security vulnerabilities in our code, and I find it completely reliable in terms of security. My advice for others considering Semgrep is that if you have large repositories, there are very few tools on the market that can provide security scanning and identify vulnerabilities quickly. Semgrep is one of those tools that performs very efficiently. If security is a concern for you, I recommend trying the free version first; if it proves beneficial for your organization, then make an organizational decision to onboard it.
It streamlines with the governance and compliance of the country where the company operates. It follows GDPR guidelines and EU guidelines. In India, I follow certain guidelines, so it also passes that criteria to go through those guidelines and follow the restrictions and suggestions provided at a national level.
My advice for others considering Semgrep is to adopt it, as it stands out in the open-source market and shows solid growth. You can trust it based on its innovative developments. I believe Semgrep will scale effectively with the rise of agentic AI and security needs, leading to broader adoption among companies. Sharing wins at open-source conferences will help demonstrate its potential impact. I rate this review an 8.
My advice to others looking into using Semgrep is to keep in mind that this is an open-source tool. I gave Semgrep an overall rating of 6.5 out of 10.
The first thing you need to do is to integrate Semgrep with your CI/CD pipelines and once they are running, invest time in reading documentation and getting yourself familiar with all of the products offered and all of the capabilities available. Semgrep was found through the peer link navigator that was provided via a LinkedIn message. The overall review rating for this product is 6 out of 10.
You should primarily focus on what your use case is and why you are moving out. If you are moving out just from the perspective of cost, I do not think Semgrep is the best solution for you. However, if you are looking for value for investment and want to have the complete visibility into your code with less noise, if you are not just looking for a SAST but are really looking for actionable results and want to improve your developer experience and feedback, then you should go for Semgrep. In my organization, it is not only me who selects the solution; I bring in developers from junior and senior levels of all experience and ask them to take a hands-on experience and give me feedback. If you want to improve the developer experience, then go for Semgrep. Compared to other competitors in the market, the AI-backed capability is the biggest strength of Semgrep. The seamless integration is another major advantage because I have done it for a few other solutions, some of which are extremely difficult and some are okay, but the Semgrep integration with the code repository was the smoothest. The quality of results and reduction in noise are also strengths compared to other competitors. Semgrep also has a great strength in the number of rule sets they have compared to all other vendors. While all other vendors have very limited numbers even though they claim to be enterprise, their community edition itself has close to 4,000 rules and the enterprise edition has around 20,000 rules. That is a really strong advantage. As for limitations, I would say that Semgrep currently just supports Jira and Slack for integrations. They should expand to different integrations like ServiceNow and other CNAP and CSPM solutions where all results can be brought into one place. I would rate this review an 8 out of 10.
I'd rate the solution eight out of ten.