Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Code scanning at ludicrous speed.
Semgrep accelerates your security journey by swiftly scanning code and package dependencies for known issues, software vulnerabilities, and detected secrets with unparalleled efficiency. Semgrep offers:
Semgrep analyzes code locally on your computer or in your build environment: by default, code is never uploaded. Get started →.
Language support
Semgrep Code supports 30+ languages.
Category Languages
GA C# · Go · Java · JavaScript · JSX · JSON · PHP · Python · Ruby · Scala · Terraform · TypeScript · TSX
Beta Kotlin · Rust
Experimental Bash · C · C++ · Clojure · Dart · Dockerfile · Elixir · HTML · Julia · Jsonnet · Lisp · Lua · OCaml · R · Scheme · Solidity · Swift · YAML · XML · Generic (ERB, Jinja, etc.)
Semgrep Supply Chain supports 8 languages across 15 package managers.
Category Languages
GA
Go (Go modules, go mod
) · Javascript/Typescript (npm, Yarn, Yarn 2, Yarn 3, pnpm) · Python (pip, pip-tool, Pipenv, Poetry) · Ruby (RubyGems) · Java (Gradle, Maven)
Beta C# (NuGet)
Lock file-only Rust (Cargo) · PHP (Composer)
For more information, visit our supported languages page.
Getting started 🚀
For new users, we recommend starting with the Semgrep Cloud Platform because it provides a visual interface, a demo project, result triaging and exploration workflows, and makes setup in CI/CD fast. Scans are still local and code isn't uploaded. Alternatively, you can also start with the CLI and navigate the terminal output to run one-off searches.
Option 1: Getting started from the Semgrep Cloud Platform (Recommended)
Register on semgrep.dev
Explore the demo findings to learn how Semgrep works
Scan your project by navigating to Projects > Scan New Project > Run scan in CI
Select your version control system and follow the onboarding steps to add your project. After this setup, Semgrep will scan your project after every pull request.
[Optional] If you want to run Semgrep locally, follow the steps in the CLI section.
Notes:
If there are any issues, please ask for help in the Semgrep Slack.
Option 2: Getting started from the CLI
# For macOS
$ brew install semgrep
For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep
To try Semgrep without installation run via Docker
$ docker run -it -v "${PWD}:/src" returntocorp/semgrep semgrep login
$ docker run -e SEMGREP_APP_TOKEN=<TOKEN> --rm -v "${PWD}:/src" returntocorp/semgrep semgrep ci
semgrep login
to create your account and login to Semgrep.Logging into Semgrep gets you access to:
semgrep ci
. This will scan your project to check for vulnerabilities in your source code and its dependencies.Semgrep Ecosystem
The Semgrep ecosystem includes the following products:
To learn more about Semgrep, visit:
Join hundreds of thousands of other developers and security engineers already using Semgrep at companies like GitLab, Dropbox, Slack, Figma, Shopify, HashiCorp, Snowflake, and Trail of Bits.
Semgrep is developed and commercially supported by Semgrep, Inc., a software security company.
Semgrep Rules
Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python print()
statements.
Run it online in Semgrep’s Playground by clicking here.
Examples
Visit Docs > Rule examples for use cases and ideas.
Use case Semgrep rule
Ban dangerous APIs Prevent use of exec
Search routes and authentication Extract Spring routes
Enforce the use secure defaults Securely set Flask cookies
Tainted data flowing into sinks ExpressJS dataflow into sandbox.run
Enforce project best-practices
Use assertEqual for == checks, Always check subprocess calls
Codify project-specific knowledge Verify transactions before making them
Audit security hotspots
Finding XSS in Apache Airflow, Hardcoded credentials
Audit configuration files Find S3 ARN uses
Migrate from deprecated APIs
DES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs
Apply automatic fixes Use listenAndServeTLS
Extensions
Visit Docs > Extensions to learn about using Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!
Documentation
Browse the full Semgrep documentation on the website. If you’re new to Semgrep, check out Docs > Getting started or the interactive tutorial.
Metrics
Using remote configuration from the Registry (like --config=p/ci
) reports pseudonymous rule metrics to semgrep.dev.
Using configs from local files (like --config=xyz.yml
) does not enable metrics.
To disable Registry rule metrics, use --metrics=off
.
The Semgrep privacy policy describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.
More
Upgrading
To upgrade, run the command below associated with how you installed Semgrep:
# Using Homebrew $ brew upgrade semgrepUsing pip
$ python3 -m pip install --upgrade semgrep
Using Docker
$ docker pull returntocorp/semgrep:latest
Twice a month we will interview people behind open source businesses. We will talk about how they are building a business on top of open source projects.
We'll never share your email with anyone else.