NodeJsScan vs Semgrep Code

NodeJsScan is a static application security testing scanner for Node.js application source code. Its detection engine uses libsast and Semgrep, and the project provides a web interface, command-line interface, and Python API through njsscan. A local setup runs the web interface at http://127.0.0.1:9090. CLI results can be exported as JSON, SARIF 2.1.0, SonarQube, DefectDojo, GitLab SAST, or HTML. The .njsscan configuration file lets users set scanned file types, ignored paths and rules, severity filters, and severity overrides. Documented CI/CD integrations include GitHub Actions, GitHub Code Scanning, GitLab CI/CD, Travis CI, and CircleCI. Alerts can go to Slack through a webhook or to email using SMTP settings. Teams can run a prebuilt Docker image or build the image locally. The project describes use in CI/CD and DevSecOps pipelines. NodeJsScan is free and licensed under GPL-3.0. The current njsscan package requires Python 3.10 or newer and supports macOS and Linux; NodeJsScan version 4 onward dropped Windows support.

Semgrep Code is a cloud-based static application security testing product for finding vulnerabilities in source code and helping developers address them. It combines deterministic analysis for issues such as XSS and SQL injection with AI analysis aimed at complex flaws, including IDOR and business logic vulnerabilities. Pull requests can carry tailored, step-by-step remediation instructions, and the product supports 35 programming languages. Semgrep lists integrations with GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure and Buildkite, plus VS Code and IntelliJ extensions and Slack, email and webhook notifications. The Free Edition includes Code and Supply Chain, with scanning for up to 10 repositories and a limit of 10 contributors. Teams supports up to 500 private repositories; Enterprise has no repository or contributor limit. For local or fully CI-based scans, code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model. The Free Edition costs nothing. Teams — Code is listed at $30 a month.