Tech riderRev. 30 Sept 2026

Semgrep Code

Ch 097.4of 39 Static Analysis Tools

1Runs onAPI, Browser, Linux, Mac, self-hosted, Web, Windows
2CostsFree plan · paid from $30/mo

2 lines stated Written from the maker's own pages: semgrep.dev

Visit site Alternatives

Overview

Semgrep Code is a cloud-based static application security testing product for finding vulnerabilities in source code and helping developers address them. It combines deterministic analysis for issues such as XSS and SQL injection with AI analysis aimed at complex flaws, including IDOR and business logic vulnerabilities. Pull requests can carry tailored, step-by-step remediation instructions, and the product supports 35 programming languages. Semgrep lists integrations with GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure and Buildkite, plus VS Code and IntelliJ extensions and Slack, email and webhook notifications. The Free Edition includes Code and Supply Chain, with scanning for up to 10 repositories and a limit of 10 contributors. Teams supports up to 500 private repositories; Enterprise has no repository or contributor limit. For local or fully CI-based scans, code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model. The Free Edition costs 0.00 USD per free. Teams — Code is listed at 30.00 USD per month.

Who it is for

It suits development teams that want code vulnerability findings and remediation guidance in pull requests, IDEs, or CI workflows. Its plan limits give small teams a free entry point and larger organizations a route to higher repository and contributor limits.

What is good

Combines deterministic and AI-based detection.
Pull requests can include step-by-step remediation.
Supports 35 programming languages.
Free Edition scans up to 10 repositories.
Lists GitHub, GitLab, Bitbucket and CI integrations.

What to know first

Free Edition caps contributors at 10.
Teams — Code costs 30.00 USD per month.
AI processing sends part of a finding file to a model.

Verdict

Semgrep Code brings code scanning and remediation guidance into development workflows, with a free tier and larger paid plans. Check the repository and contributor caps, and whether AI processing fits your code-handling requirements.

Semgrep Code plans and pricing

All plans

Free Edition Free Free Code and Supply Chain included · up to 10 repositories · maximum 10 contributors · 60 AI credits semgrep.dev · 30 Sept 2026

Teams — Code $30/mo $30/month/contributor Code (SAST) · 20 AI credits per developer per month · 500 private repositories maximum semgrep.dev · 30 Sept 2026

Enterprise Not published Custom No limit on repositories or contributors · 50 AI credits per developer per month · dedicated account manager semgrep.dev · 30 Sept 2026

Compared on static analysis tools

Free plan: Yessemgrep.dev

Facts

Purpose: Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them.semgrep.dev · 30 Sept 2026
Detection: Its multimodal detection combines deterministic SAST for issues such as XSS and SQL injection with AI analysis for complex flaws such as IDOR and business logic vulnerabilities.semgrep.dev · 30 Sept 2026
Languages: The pricing comparison lists support for 35+ programming languages.semgrep.dev · 30 Sept 2026
Triage: Semgrep says Multimodal can reduce findings requiring triage by 20% on activation and improve as it learns from triage decisions.semgrep.dev · 30 Sept 2026
Remediation: The product provides tailored, step-by-step remediation instructions in pull requests.semgrep.dev · 30 Sept 2026
Integrations: The integrations page lists GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, and Buildkite among supported SCM and CI tools.semgrep.dev · 30 Sept 2026
Developer workflow: The integrations page lists VS Code and IntelliJ IDE extensions, and Slack, email, and webhooks for notifications.semgrep.dev · 30 Sept 2026
Free tier limits: The Free Edition includes Code and Supply Chain, allows scanning up to 10 repositories, and has a maximum of 10 contributors.semgrep.dev · 30 Sept 2026
Paid tier limits: Teams supports up to 500 private repositories, while Enterprise has no repository or contributor limit.semgrep.dev · 30 Sept 2026
Code handling: For local or fully CI-based scans, Semgrep says source code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model.semgrep.dev · 30 Sept 2026
Compliance: Semgrep's trust portal describes a SOC 2 Type II report and a full-scope third-party penetration test covering the Semgrep AppSec Platform, including Semgrep Code.trust.semgrep.dev · 30 Sept 2026
Support: The pricing page lists community-based support for Free Edition, award-winning support for Teams, and dedicated account management and tailored onboarding for Enterprise.semgrep.dev · 30 Sept 2026