Semgrep
by Semgrep
Lightweight static analysis for finding bugs and enforcing code standards
Visit semgrep.dev FreemiumOpen source
Semgrep is a fast static analysis tool that matches code patterns that look like source code. It ships security rulesets for many languages and lets teams write custom rules; a commercial platform adds supply-chain and secrets scanning.
Key features
- Pattern rules that look like source code
- Community security rulesets
- Supports 30+ languages
- CLI and CI integrations
Similar tools
CodeQL
GitHub's semantic code analysis engine for finding vulnerabilities
OSV-Scanner
Scan dependencies for known vulnerabilities using the OSV.dev database
Trivy
Find vulnerabilities, misconfigurations, and secrets in containers and code
TruffleHog
Find and verify leaked credentials in code, history, and cloud storage
ZAP
Open-source web application security scanner and intercepting proxy
ESLint
Pluggable linter that finds and fixes problems in JavaScript and TypeScript
