Bandit vs Semgrep Code
Bandit
github.com
Semgrep Code
semgrep.devSide by side
| Figure | Bandit | Semgrep Code |
|---|---|---|
| Price from | Free | $15/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | Yes | Yes |
| Web | — | Yes |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 2 | 7 |
| Spec score · SAST Tools | 9.0 (#1) | 8.7 (#3) |
| Spec score · Static Application Security Testing Software | 9.0 (#1) | 8.7 (#2) |
| Documentation depth | The documentation site includes getting started, configuration, integrations, plugin references, formatter references, CI/CD guidance, FAQs, and API modules. | Documentation covers scanning, rule writing, CLI commands, APIs, integrations, billing, support and release notes, with community Slack and GitHub issue support. |
| Installation | The documented primary installation method is pip, with optional extras for TOML, baseline, and SARIF support. | Official installation paths include Homebrew on macOS, pip on Windows and Linux, and a semgrep/semgrep Docker image on Linux. |
| Integrations | Official integration documentation lists VS Code, Sublime Text, Vim/Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8. | Supported workflow connections include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, Buildkite, HackerOne, Slack, email, webhooks, VS Code and IntelliJ. |
| Purpose | Bandit scans Python code to find common security issues by building an AST and running plugins against its nodes. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
| Support | The documentation links to the GitHub issue tracker and a Bandit Discord community. | Paid customers receive technical support from 8 AM to 1 AM UTC on weekdays through private Slack, the web help area or support email. |
| What it does | Bandit parses Python files into abstract syntax trees, applies security-test plugins, and produces a report. | Semgrep Code combines deterministic static analysis with AI analysis to identify traditional vulnerabilities such as XSS and SQL injection plus complex issues such as IDOR and business-logic flaws. |
Plans
Semgrep Code
- Free EditionFree
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
In their own words
Bandit
Bandit is free software for finding common security issues in Python source code. It builds an abstract syntax tree from scanned files and runs plugins against that tree, then produces a report. A JSON baseline can exclude findings that a team considers non-issues. The project is distributed through PyPI and recommends installation with pip. It runs on Linux and macOS and can be used in self-hosted environments. Optional installation extras add TOML support, the bandit-baseline command-line tool, and SARIF output formatting. Documentation describes pre-commit configuration and integrations with Visual Studio Code, Sublime Text, Vim, Neovim, Emacs, GitHub Actions, Jenkins, Ruff, and Flake8. A published container image supports amd64, arm64, armv7, and armv8 architectures. The project says images are signed with Sigstore Cosign and provides source-verification instructions. Bandit is licensed under Apache License 2.0, with support links to GitHub issues and Discord.
Semgrep Code
Semgrep Code is a cloud-based static application security testing product for finding vulnerabilities in source code and helping developers address them. It combines deterministic analysis for issues such as XSS and SQL injection with AI analysis aimed at complex flaws, including IDOR and business logic vulnerabilities. Pull requests can carry tailored, step-by-step remediation instructions, and the product supports 35 programming languages. Semgrep lists integrations with GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure and Buildkite, plus VS Code and IntelliJ extensions and Slack, email and webhook notifications. The Free Edition includes Code and Supply Chain, with scanning for up to 10 repositories and a limit of 10 contributors. Teams supports up to 500 private repositories; Enterprise has no repository or contributor limit. For local or fully CI-based scans, code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model. The Free Edition costs nothing. Teams — Code is listed at $30 a month.