Security Code Scan vs Semgrep Code
Security Code Scan
security-code-scan.github.io
Semgrep Code
semgrep.devSide by side
| Figure | Security Code Scan | Semgrep Code |
|---|---|---|
| Price from | Free | $15/mo |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Web | — | Yes |
| Windows | Yes | Yes |
| macOS | — | Yes |
| Linux | Yes | Yes |
| API | — | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 1 | 7 |
| Spec score · SAST Tools | 7.4 (#19) | 8.7 (#3) |
| Detection | It detects patterns including SQL injection, cross-site scripting, CSRF, and XML external entity injection. | Its multimodal detection combines deterministic SAST for issues such as XSS and SQL injection with AI analysis for complex flaws such as IDOR and business logic vulnerabilities. |
| Integrations | The site lists GitHub and GitLab pipeline support, plus MSBuild and a stand-alone runner for custom integrations. | Supported workflow connections include GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure, Buildkite, HackerOne, Slack, email, webhooks, VS Code and IntelliJ. |
| Purpose | Security Code Scan is a static code analyzer for .NET that detects vulnerability patterns in C# and VB.NET. | Semgrep Code is a static application security testing product that finds code vulnerabilities and helps developers fix them. |
| Support | The maker provides a troubleshooting guide and directs users to project issues and contributions on GitHub. | Paid customers receive technical support from 8 AM to 1 AM UTC on weekdays through private Slack, the web help area or support email. |
Plans
Semgrep Code
- Free EditionFree
- Free EditionFree
- Teams Secrets$15 a month
- Teams — Code$30 a month
- Teams Code$30 a month
- Teams Supply Chain$30 a month
- EnterprisePriced on request
In their own words
Security Code Scan
Security Code Scan is a free, open-source static analyzer for .NET projects written in C# and VB.NET. It detects vulnerability patterns such as SQL injection, cross-site scripting, CSRF, and XML external entity injection, using inter-procedural taint analysis to follow input data. Projects can be analyzed in the background through IntelliSense or during a build. For delivery workflows, it supports GitHub and GitLab pipelines, MSBuild, and a stand-alone runner; custom integrations can emit SARIF results and place warnings alongside other build messages. Users can define taint sources, sinks, sanitizers, validators, and project-specific settings. The analyzer supports Visual Studio 2019 or higher, while the project says other Roslyn analyzer editors such as Rider or OmniSharp should work. Releases are available as a NuGet package, Visual Studio extension, and stand-alone runner for Windows and Linux. The maker warns that the extension or NuGet package can slow the IDE and recommends CI/CD pipelines as the more common use case. Audit mode is off by default. The repository identifies an LGPL-3.0 license.
Semgrep Code
Semgrep Code is a cloud-based static application security testing product for finding vulnerabilities in source code and helping developers address them. It combines deterministic analysis for issues such as XSS and SQL injection with AI analysis aimed at complex flaws, including IDOR and business logic vulnerabilities. Pull requests can carry tailored, step-by-step remediation instructions, and the product supports 35 programming languages. Semgrep lists integrations with GitHub, GitLab, Bitbucket, Jenkins, CircleCI, Azure and Buildkite, plus VS Code and IntelliJ extensions and Slack, email and webhook notifications. The Free Edition includes Code and Supply Chain, with scanning for up to 10 repositories and a limit of 10 contributors. Teams supports up to 500 private repositories; Enterprise has no repository or contributor limit. For local or fully CI-based scans, code stays on the user's computer or CI environment; opting into AI processing sends part of a file containing a finding to a model. The Free Edition costs nothing. Teams — Code is listed at $30 a month.