Home

Awesome

<br /> <p align="center"> <a href="https://semgrep.dev"> <picture> <source media="(prefers-color-scheme: light)" srcset="images/semgrep-logo-light.svg"> <source media="(prefers-color-scheme: dark)" srcset="images/semgrep-logo-dark.svg"> <img src="https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-logo-light.svg" height="100" alt="Semgrep logo"/> </picture> </a> </p> <h2 align="center"> Code scanning at ludicrous speed. </h2> <p align="center"> <a href="https://formulae.brew.sh/formula/semgrep"> <img src="https://img.shields.io/homebrew/v/semgrep?style=flat-square" alt="Homebrew" /> </a> <a href="https://pypi.org/project/semgrep/"> <img alt="PyPI" src="https://img.shields.io/pypi/v/semgrep?style=flat-square&color=blue"> </a> <a href="https://semgrep.dev/docs/"> <img src="https://img.shields.io/badge/docs-semgrep.dev-purple?style=flat-square" alt="Documentation" /> </a> <a href="https://go.semgrep.dev/slack"> <img src="https://img.shields.io/badge/slack-3.5k%20members-green?style=flat-square" alt="Join Semgrep community Slack" /> </a> <a href="https://github.com/semgrep/semgrep/issues/new/choose"> <img src="https://img.shields.io/badge/issues-welcome-green?style=flat-square" alt="Issues welcome!" /> </a> <a href="https://github.com/semgrep/semgrep#readme"> <img src="https://img.shields.io/github/stars/semgrep/semgrep?label=GitHub%20Stars&style=flat-square" alt="Star Semgrep on GitHub" /> </a> <a href="https://hub.docker.com/r/semgrep/semgrep"> <img src="https://img.shields.io/docker/pulls/semgrep/semgrep.svg?style=flat-square" alt="Docker Pulls" /> </a> <a href="https://hub.docker.com/r/returntocorp/semgrep"> <img src="https://img.shields.io/docker/pulls/returntocorp/semgrep.svg?style=flat-square" alt="Docker Pulls (Old)" /> </a> <a href="https://twitter.com/intent/follow?screen_name=semgrep"> <img src="https://img.shields.io/twitter/follow/semgrep?label=Follow%20semgrep&style=social&color=blue" alt="Follow @semgrep on Twitter" /> </a> </p> </br>

Semgrep is a fast, open-source, static analysis tool that searches code, finds bugs, and enforces secure guardrails and coding standards. Semgrep supports 30+ languages and can run in an IDE, as a pre-commit check, and as part of CI/CD workflows.

Semgrep is semantic grep for code. While running grep "2" would only match the exact string 2, Semgrep would match x = 1; y = x + 1 when searching for 2. Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs.

Note that in security contexts, Semgrep OSS will miss many true positives as it can only analyze code within the boundaries of a single function or file. If you want to use Semgrep for security purposes (SAST, SCA, or secrets scanning), the Semgrep AppSec Platform is strongly recommended since it adds the following critical capabilities:

  1. Improved core analysis capabilities (cross-file, cross-function, data-flow reachability) that greatly reduce false positives by 25% and increase detected true positives by 250%
  2. Contextual post-processing of findings with Semgrep Assistant (AI) to further reduce noise by ~20%. In addition, Assistant enriches findings with tailored, step-by-step remediation guidance that humans find actionable >80% of the time.
  3. Customizable policies and seamless integration into developer workflows, giving security teams granular control over where, when, and how different findings are presented to developers (IDE, PR comment, etc.)

The Semgrep AppSec Platform works out-of-the-box with 20000+ proprietary rules across SAST, SCA, and secrets. Pro rules are written and maintained by the Semgrep security research team and are highly accurate, meaning AppSec teams can feel confident bringing findings directly to developers without slowing them down.

Semgrep analyzes code locally on your computer or in your build environment: by default, code is never uploaded. Get started →.

<a href="#option-1-getting-started-from-the-cli"> <img src="https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-scan-cli.jpg" alt="Semgrep CLI image"/></a>

Language support

Semgrep Code supports 30+ languages, including:

Apex · Bash · C · C++ · C# · Clojure · Dart · Dockerfile · Elixir · HTML · Go · Java · JavaScript · JSX · JSON · Julia · Jsonnet · Kotlin · Lisp · Lua · OCaml · PHP · Python · R · Ruby · Rust · Scala · Scheme · Solidity · Swift · Terraform · TypeScript · TSX · YAML · XML · Generic (ERB, Jinja, etc.)

Semgrep Supply Chain supports 12 languages across 15 package managers, including:

C# (NuGet) · Dart (Pub) · Go (Go modules, go mod) · Java (Gradle, Maven) · Javascript/Typescript (npm, Yarn, Yarn 2, Yarn 3, pnpm) · Kotlin (Gradle, Maven) · PHP (Composer) · Python (pip, pip-tool, Pipenv, Poetry) · Ruby (RubyGems) · Rust (Cargo) · Scala (Maven) · Swift (SwiftPM)

For more information, see Supported languages.

Getting started 🚀

  1. From the Semgrep AppSec Platform
  2. From the CLI

For new users, we recommend starting with the Semgrep AppSec Platform because it provides a visual interface, a demo project, result triaging and exploration workflows, and makes setup in CI/CD fast. Scans are still local and code isn't uploaded. Alternatively, you can also start with the CLI and navigate the terminal output to run one-off searches.

Option 1: Getting started from the Semgrep Appsec Platform (Recommended)

<a href="https://go.semgrep.dev/login-ghrmgo" target="_blank"><img src="https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-main-image.jpg" alt="Semgrep platform image"/> </a>

  1. Register on <a href="https://go.semgrep.dev/login-ghrmgo" target="_blank">semgrep.dev</a>

  2. Explore the demo findings to learn how Semgrep works

  3. Scan your project by navigating to Projects > Scan New Project > Run scan in CI

  4. Select your version control system and follow the onboarding steps to add your project. After this setup, Semgrep will scan your project after every pull request.

  5. [Optional] If you want to run Semgrep locally, follow the steps in the CLI section.

Notes:

If there are any issues, <a href="https://go.semgrep.dev/slack" target="_blank">please ask for help in the Semgrep Slack</a>.

Option 2: Getting started from the CLI

  1. Install Semgrep CLI
# For macOS
$ brew install semgrep

# For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep

# To try Semgrep without installation run via Docker
$ docker run -it -v "${PWD}:/src" semgrep/semgrep semgrep login
$ docker run -e SEMGREP_APP_TOKEN=<TOKEN> --rm -v "${PWD}:/src" semgrep/semgrep semgrep ci
  1. Run semgrep login to create your account and login to Semgrep.

Logging into Semgrep gets you access to:

  1. Go to your app's root directory and run semgrep ci. This will scan your project to check for vulnerabilities in your source code and its dependencies.

  2. Try writing your own query interactively with -e. For example, a check for Python == where the left and right hand sides are the same (potentially a bug): $ semgrep -e '$X == $X' --lang=py path/to/src

Semgrep Ecosystem

The Semgrep ecosystem includes the following:

Additional resources:

Join hundreds of thousands of other developers and security engineers already using Semgrep at companies like GitLab, Dropbox, Slack, Figma, Shopify, HashiCorp, Snowflake, and Trail of Bits.

Semgrep is developed and commercially supported by Semgrep, Inc., a software security company.

Semgrep Rules

Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python print() statements.

Run it online in Semgrep’s Playground by clicking here.

<p align="center"> <a href="https://semgrep.dev/playground/r/3qUzQD/ievans.print-to-logger" target="_blank"><img src="https://raw.githubusercontent.com/semgrep/semgrep/develop/images/semgrep-example-rules-editor.jpg" width="582" alt="Semgrep rule example for finding Python print() statements" /></a> </p>

Examples

Visit Docs > Rule examples for use cases and ideas.

Use caseSemgrep rule
Ban dangerous APIsPrevent use of exec
Search routes and authenticationExtract Spring routes
Enforce the use secure defaultsSecurely set Flask cookies
Tainted data flowing into sinksExpressJS dataflow into sandbox.run
Enforce project best-practicesUse assertEqual for == checks, Always check subprocess calls
Codify project-specific knowledgeVerify transactions before making them
Audit security hotspotsFinding XSS in Apache Airflow, Hardcoded credentials
Audit configuration filesFind S3 ARN uses
Migrate from deprecated APIsDES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs
Apply automatic fixesUse listenAndServeTLS

Extensions

Visit Docs > Extensions to learn about using Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!

Documentation

Browse the full Semgrep documentation on the website. If you’re new to Semgrep, check out Docs > Getting started or the interactive tutorial.

Metrics

Using remote configuration from the Registry (like --config=p/ci) reports pseudonymous rule metrics to semgrep.dev.

Using configs from local files (like --config=xyz.yml) does not enable metrics.

To disable Registry rule metrics, use --metrics=off.

The Semgrep privacy policy describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.

More

Upgrading

To upgrade, run the command below associated with how you installed Semgrep:

# Using Homebrew
$ brew upgrade semgrep

# Using pip
$ python3 -m pip install --upgrade semgrep

# Using Docker
$ docker pull semgrep/semgrep:latest