Skip to main content

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Project description


Semgrep logo

Lightweight static analysis for many languages.
Find bugs and enforce code standards.

Homebrew PyPI Documentation Join Semgrep community Slack Issues welcome! Star Semgrep on GitHub Follow @r2cdev on Twitter


Semgrep is a fast, open-source, static analysis tool for finding bugs and enforcing code standards at editor, commit, and CI time. Get started →.

Semgrep analyzes code locally on your computer or in your build environment: code is never uploaded.

Its rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python print() statements, run it online in Semgrep's Playground by clicking the image:

Semgrep rule example for finding Python print() statements

The Semgrep ecosystem includes:

  • Semgrep - the open-source command line tool at the heart of everything (this project)
  • Semgrep CI - a specialized Docker image for running Semgrep in CI environments
  • Semgrep Playground - an online interactive rule builder for writing and sharing rules
  • Semgrep Registry - 1,000+ community-driven rules covering security, correctness, and performance bugs
  • Semgrep App - deploy, manage, and monitor Semgrep at scale with free and paid tiers.

Join 100,000 other developers and security engineers already using Semgrep at companies like Chef, Dropbox, Figma, HashiCorp, Snowflake, and Trail of Bits. Also check out tools powered by Semgrep!

Semgrep is developed and commercially supported by r2c, a software security company.

Language support

General availability

C# · Go · Java · JavaScript · JSX · JSON · Python · Ruby · TypeScript · TSX

Beta & experimental

See supported languages for the complete list.

Getting started

To install Semgrep use Homebrew or pip, or run without installation via Docker:

# For macOS
$ brew install semgrep

# For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep

# To try Semgrep without installation run via Docker
$ docker run --rm -v "${PWD}:/src" returntocorp/semgrep --help

Once installed, Semgrep can run with single rules or entire rulesets. Visit Docs > Running rules to learn more or try the following:

# Check for Python == where the left and right hand sides are the same (often a bug)
$ semgrep -e '$X == $X' --lang=py path/to/src

# Fetch rules automatically by setting the `--config auto` flag.
# This will fetch rules relevant to your project from Semgrep Registry.
# The name of your project will be sent to Semgrep Registry as an identifier
# to make selecting relevant rules fast next time;
# source code will not be uploaded.
$ semgrep --config auto

# Run the r2c-ci ruleset (with rules for many languages) on your own code!
$ semgrep --config=p/r2c-ci path/to/src

Visit the full documentation to learn more.

Rule examples

Visit Docs > Rule examples for use cases and ideas.

Use case Semgrep rule
Ban dangerous APIs Prevent use of exec
Search routes and authentication Extract Spring routes
Enforce the use secure defaults Securely set Flask cookies
Tainted data flowing into sinks ExpressJS dataflow into sandbox.run
Enforce project best-practices Use assertEqual for == checks, Always check subprocess calls
Codify project-specific knowledge Verify transactions before making them
Audit security hotspots Finding XSS in Apache Airflow, Hardcoded credentials
Audit configuration files Find S3 ARN uses
Migrate from deprecated APIs DES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs
Apply automatic fixes Use listenAndServeTLS

Extensions

Visit Docs > Extensions to learn about Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!

Documentation

Browse the full Semgrep documentation on the website. If you’re new to Semgrep, check out Docs > Getting started or the interactive tutorial.

Metrics

Using remote configuration from the Registry (like --config=p/ci) reports pseudonymous rule metrics to semgrep.dev.

Using configs from local files (like --config=xyz.yml) does not enable metrics.

To disable Registry rule metrics, use --metrics=off.

PRIVACY.md describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.

More

Upgrading

To upgrade, run the command below associated with how you installed Semgrep:

# Using Homebrew
$ brew upgrade semgrep

# Using pip
$ python3 -m pip install --upgrade semgrep

# Using Docker
$ docker pull returntocorp/semgrep:latest

Project details


Release history Release notifications | RSS feed

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

semgrep-0.85.0.tar.gz (151.1 kB view details)

Uploaded Source

Built Distributions

semgrep-0.85.0-cp37.cp38.cp39.py37.py38.py39-none-macosx_10_14_x86_64.whl (19.7 MB view details)

Uploaded CPython 3.7 CPython 3.8 CPython 3.9 Python 3.7 Python 3.8 Python 3.9 macOS 10.14+ x86-64

semgrep-0.85.0-cp37.cp38.cp39.py37.py38.py39-none-any.whl (22.8 MB view details)

Uploaded CPython 3.7 CPython 3.8 CPython 3.9 Python 3.7 Python 3.8 Python 3.9

File details

Details for the file semgrep-0.85.0.tar.gz.

File metadata

  • Download URL: semgrep-0.85.0.tar.gz
  • Upload date:
  • Size: 151.1 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.8.0 pkginfo/1.8.2 readme-renderer/34.0 requests/2.27.1 requests-toolbelt/0.9.1 urllib3/1.26.9 tqdm/4.63.0 importlib-metadata/4.11.3 keyring/23.5.0 rfc3986/2.0.0 colorama/0.4.4 CPython/3.9.10

File hashes

Hashes for semgrep-0.85.0.tar.gz
Algorithm Hash digest
SHA256 2452f039d1885b3b32729999bef8959d84eb82512fabe7321b7fa7735e173771
MD5 3706dcc58d50c9632f7e571a79c6e777
BLAKE2b-256 c7bfc25d3932651963a0724f36fc16732eecf2122ab530d14454385eca14f3ff

See more details on using hashes here.

File details

Details for the file semgrep-0.85.0-cp37.cp38.cp39.py37.py38.py39-none-macosx_10_14_x86_64.whl.

File metadata

  • Download URL: semgrep-0.85.0-cp37.cp38.cp39.py37.py38.py39-none-macosx_10_14_x86_64.whl
  • Upload date:
  • Size: 19.7 MB
  • Tags: CPython 3.7, CPython 3.8, CPython 3.9, Python 3.7, Python 3.8, Python 3.9, macOS 10.14+ x86-64
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.8.0 pkginfo/1.8.2 readme-renderer/34.0 requests/2.27.1 requests-toolbelt/0.9.1 urllib3/1.26.9 tqdm/4.63.0 importlib-metadata/4.11.3 keyring/23.5.0 rfc3986/2.0.0 colorama/0.4.4 CPython/3.9.10

File hashes

Hashes for semgrep-0.85.0-cp37.cp38.cp39.py37.py38.py39-none-macosx_10_14_x86_64.whl
Algorithm Hash digest
SHA256 4c89f2044961d4aa983e4e698ee8836c06b2e415e974d65ffd5559e6e642a0da
MD5 bf0bd74d7618e00a4ee174a6cb48be37
BLAKE2b-256 bea4278d55b31f29e4a9ab0ec96f26e5e9cf80b97c1f1733ffb156d554a88108

See more details on using hashes here.

File details

Details for the file semgrep-0.85.0-cp37.cp38.cp39.py37.py38.py39-none-any.whl.

File metadata

  • Download URL: semgrep-0.85.0-cp37.cp38.cp39.py37.py38.py39-none-any.whl
  • Upload date:
  • Size: 22.8 MB
  • Tags: CPython 3.7, CPython 3.8, CPython 3.9, Python 3.7, Python 3.8, Python 3.9
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/3.8.0 pkginfo/1.8.2 readme-renderer/34.0 requests/2.27.1 requests-toolbelt/0.9.1 urllib3/1.26.9 tqdm/4.63.0 importlib-metadata/4.11.3 keyring/23.5.0 rfc3986/2.0.0 colorama/0.4.4 CPython/3.9.10

File hashes

Hashes for semgrep-0.85.0-cp37.cp38.cp39.py37.py38.py39-none-any.whl
Algorithm Hash digest
SHA256 3b734e35100f00f676cf2e56f3241699222168fa015d55c9919833da0234b6c5
MD5 66809f316bcf31f4d7197be918a1a559
BLAKE2b-256 41cf14b11c2f38343926b308e948fed17c17673b343fd183eb9b9f201b7b49b8

See more details on using hashes here.

Supported by

AWS AWS Cloud computing and Security Sponsor Datadog Datadog Monitoring Fastly Fastly CDN Google Google Download Analytics Microsoft Microsoft PSF Sponsor Pingdom Pingdom Monitoring Sentry Sentry Error logging StatusPage StatusPage Status page