static analysis

Semgrep

Semgrep is a static analysis product that matches patterns across a codebase. This profile covers what it does, how it is priced, and where it stops being the right choice.

What the product actually does

Semgrep is a static analysis tool that matches code patterns rather than parsing to an abstract syntax tree and running a fixed rule set. Rules are written in something close to the target language's own syntax, which means a security engineer can write a rule for a pattern they have seen without learning a query language.

The practical result is that Semgrep is fast enough to run on every commit and extensible enough that teams actually write their own rules. Most static analysis tools fail on one of those two.

How pricing works once you are inside

The open-source engine is free and covers the core matching. Semgrep AppSec Platform prices per contributor per month, which is a model that scales with team size rather than code volume — good for large repositories, less good for large teams.

The paid tiers add the managed rule registry, the triage workflow and the supply-chain scanning. The registry is the substantive addition; the open-source rules are good but the commercial set is broader and better maintained.

Where it breaks down

False positives. Pattern matching is inherently approximate, and a rule that matches too broadly produces noise that trains developers to ignore the tool. Managing that requires ongoing rule curation, which is work someone has to own.

Semgrep analyses source, so it cannot see what happens at runtime — a vulnerability reachable only through a configuration path will not be caught. It complements runtime tooling rather than replacing it.

What switching costs

Low. Rules are portable and the engine is open source. The triage history and suppression decisions are the only thing lost.

Who should not use it

Teams without someone to own rule curation. An uncurated scanner becomes noise within a quarter.

Sources

Semgrep public documentation and pricing page, read October 2026.