Founder summary
Speed, owner clarity, customer trust and what must happen next.
🇺🇸 USA
Semgrep
Semgrep is attractive to teams that want code security to feel close to engineering rather than imposed from outside. It can be fast, flexible and very specific to how the team writes software. The downside is that it needs ownership: rules, triage and reporting do not magically become a full security program.
Starting price
Free; Teams from $30 / contributor / month
Per contributor
Teams pricing is per contributor and product line; Code, Supply Chain and Secrets have different price points and limits.
Official site Verified 2026-05-19
Open rating
Overall score: 59/100
Score basis: Weighted editorial score across eight visible dimensions: compliance readiness, evidence completeness, operational coverage, remediation workflow, SMB practicality, price clarity, data control and regional fit.
ConfidenceHigh confidence
Last reviewed2026-05-19
Citable rating summary
- Overall score: 59/100
- Confidence: High confidence
- Last reviewed: 2026-05-19
- Public rating dataset: /data/ratings.json
- Best fit: Engineering teams that want customizable code scanning and are willing to tune rules around how they build
- Caveats: Not enough when endpoint protection, backup proof, supplier risk or broad compliance evidence are the main pressure.
Use the vendor page and public dataset together. Do not cite the score without confidence, last-reviewed date and caveats.
Buyer mode
Neutral: Neutral buyer view: compare Semgrep by score, fit, gaps, evidence sources, pricing caveats and where it is not enough before choosing a stack.
Compliance Readiness48/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Evidence Completeness45/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Operational Coverage50/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Remediation Workflow55/100
Public docs/ Medium confidenceEditorial inference/ High confidence
SMB Practicality70/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Price / TCO clarity82/100
Pricing page/ High confidenceVendor statement/ Medium confidenceEditorial inference/ High confidence
Data Control / BYOK55/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Regional Fit80/100
Public docs/ Medium confidenceEditorial inference/ High confidence
Best fit
- Engineering teams that want customizable code scanning and are willing to tune rules around how they build
Known gaps
- Narrow code-security scope; value depends on rule quality and engineering ownership
- Teams pricing is per contributor and product line; Code, Supply Chain and Secrets have different price points and limits.
Not enough for
- Not enough when endpoint protection, backup proof, supplier risk or broad compliance evidence are the main pressure.
Evidence sources
Editorial inference/ High confidencePricing page/ High confidenceVendor statement/ High confidencePublic docs/ High confidence
Rating is directional. No tool purchase creates compliance. Use this rating as buyer guidance, then verify legal scope, implementation evidence and current vendor terms directly.
Boardroom briefs
Boardroom briefs
CFO summary
Subscription cost, quote risk, hidden owner time and audit surprises.
Auditor summary
Evidence freshness, traceability, owners, review cadence and caveats.
Security lead summary
Coverage gaps, integrations, remediation ownership and operational risk.
When not to buy
Negative-fit check
Use this section before a sales call. It is designed to reduce overbuying and false confidence, not to crown a default winner.
Do not buy this if
- Do not buy this if endpoint protection, identity, backup proof or supplier risk are the urgent gaps; developer security is only one slice.
- Do not buy this if procurement requires independently published pricing and scope before a sales or vendor conversation.
Buy this only if
- Buy this only if the strongest fit is really: Engineering teams that want customizable code scanning and are willing to tune rules around how they build.
- Buy this only if someone owns configuration, evidence capture, renewal review and follow-through after the purchase.
Pair it with
- Pair it with endpoint, identity, backup and evidence workflows so code findings become owned operational work.
Replace it when
- Replace it when the tool no longer matches the main risk, the renewal cost outruns value or evidence remains manual despite the spend.
Badge snippets
Embeddable badges
These badges show that a vendor page was reviewed in Security Stack Compare. They are not certification, endorsement or proof of compliance.
Not certification
Compared
This vendor is listed in the Security Stack Compare buyer guide with visible scores, gaps and source notes.
Not certification
Evidence workflow reviewed
This review includes evidence workflow, receipt types, remediation ownership and audit-readiness caveats.
Not certification
Pricing transparency reviewed
This review includes public pricing signals, quote requirements, hidden-cost risk and verification caveats.
Not certification
SMB fit reviewed
This review includes SMB practicality, fit by company size, operational gaps and when the tool is not enough.
Capabilities
endpointNot includedmdrNot includedvulnPartialcloudNot includedcodeStrongbackupNot includedidentityNot includedsupplierNot includedcontractNot includedevidencePartialremediationPartialexecReportsPartialbyokPartial
Best compliance fit
SOC 2
Main gap
Narrow code-security scope; value depends on rule quality and engineering ownership
How we know
Semgrep publishes Free and Teams from $30/month per contributor for Code or Supply Chain; Free has repository/contributor limits, Secrets is priced differently, and Enterprise is custom.
When to pair it
Semgrep is strongest in its core category. If the goal is audit-ready evidence, supplier risk, backup proof or cross-tool remediation, pair it with a separate evidence workflow rather than expecting this tool to cover the whole compliance program.
Evidence, remediation and reporting layer when this tool needs to support audits.
Endpoint and identity baseline.