Semgrep CE
Pattern-based code scanner whose rules look like the code they match.
github.com/semgrep/semgrep ↗- Stars
- ★ 16,947
- License
- LGPL-2.1
- Language
- C
- Latest release
- v1.180.0 · 7 Oct 2026
- Last push
- 9 Oct 2026
- OpenSSF Scorecard
- Not in the weekly scan
Fast, readable rules and a large registry, but cross-file dataflow and many rules are only in the paid product.
How it works
Semgrep parses source into a generic syntax tree for each of its supported languages and matches rules written in YAML. A rule pattern is code with metavariables ($X) and ellipses (...), so a rule for eval($USER_INPUT) looks like the code it finds. Taint mode tracks data from sources to sinks within a file.
Rules come from your own files or from the Semgrep Registry (for example --config p/ci). Since December 2024 Semgrep's own rules are under the Semgrep Rules License, which allows internal use but not use in competing products. That change led to the Opengrep fork.
Output is text, JSON, SARIF or JUnit, and --error makes the exit code non-zero on findings. The commercial engine adds cross-file and cross-function dataflow.
What it catches
- Injection sinks fed by request data (SQL, command, template)
- Dangerous functions and insecure defaults per framework
- Hardcoded credentials and weak crypto
- Your own banned patterns, written in minutes
Run it
pipx install semgrep
semgrep scan --config p/ci --metrics off --error .What leaves your machine
Registry rules are downloaded at start. Usage metrics are sent when you use registry configs unless you pass --metrics off.
Limits
- Community Edition dataflow stops at the file boundary.
- Registry rule licensing changed in 2024; check it fits how you use them.
Links
Related tools
GitHub stats as of 10 Oct 2026. How ratings work.