Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
Project description
Code scanning at ludicrous speed.
Find bugs and reachable dependency vulnerabilities in code.
Enforce your code standards on every commit.
Semgrep is a fast, open-source, static analysis engine for finding bugs, detecting vulnerabilities in third-party dependencies, and enforcing code standards. Get started →.
Semgrep analyzes code locally on your computer or in your build environment: code is never uploaded.
Its rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python print() statements. Run it online in Semgrep’s Playground by clicking the image:
The Semgrep ecosystem includes the following products:
- Semgrep OSS Engine - The open-source engine at the heart of everything (this project).
- Semgrep Cloud Platform (SCP) - Deploy, manage, and monitor SAST and SCA at scale using Semgrep, with free and paid tiers. Integrates with continuous integration (CI) providers such as GitHub, GitLab, CircleCI, and more.
- Semgrep Code - Scan your code with Semgrep's Pro rules and Semgrep Pro Engine to find OWASP Top 10 vulnerabilities and protect against critical security risks specific to your organization. Semgrep Code provides both Community (free) and Team (paid) tiers.
- Semgrep Supply Chain (SSC) - A high-signal dependency scanner that detects reachable vulnerabilities in open source third-party libraries and functions across the software development life cycle (SDLC). Semgrep Supply Chain is available on Team (paid) tiers.
and:
- Semgrep Playground - An online interactive tool for writing and sharing rules.
- Semgrep Registry - 2,000+ community-driven rules covering security, correctness, and dependency vulnerabilities.
Join hundreds of thousands of other developers and security engineers already using Semgrep at companies like GitLab, Dropbox, Slack, Figma, Shopify, HashiCorp, Snowflake, and Trail of Bits.
Semgrep is developed and commercially supported by r2c, a software security company.
Language support
General availability
C# · Go · Java · JavaScript · JSX · JSON · PHP · Python · Ruby · Scala · Terraform · TypeScript · TSX
Beta & experimental
See supported languages for the complete list.
Getting started
To install Semgrep use Homebrew or pip, or run without installation via Docker:
# For macOS
$ brew install semgrep
# For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep
# To try Semgrep without installation run via Docker
$ docker run --rm -v "${PWD}:/src" returntocorp/semgrep semgrep
Once installed, Semgrep can run with single rules or entire rulesets. Visit Docs > Running rules to learn more or try the following:
# Check for Python == where the left and right hand sides are the same (often a bug)
$ semgrep -e '$X == $X' --lang=py path/to/src
# Fetch rules automatically by setting the `--config auto` flag.
# This will fetch rules relevant to your project from Semgrep Registry.
# Your source code is not uploaded.
$ semgrep --config auto
To run Semgrep Supply Chain, contact the Semgrep team. Visit the full documentation to learn more.
Rule examples
Visit Docs > Rule examples for use cases and ideas.
| Use case | Semgrep rule |
|---|---|
| Ban dangerous APIs | Prevent use of exec |
| Search routes and authentication | Extract Spring routes |
| Enforce the use secure defaults | Securely set Flask cookies |
| Tainted data flowing into sinks | ExpressJS dataflow into sandbox.run |
| Enforce project best-practices | Use assertEqual for == checks, Always check subprocess calls |
| Codify project-specific knowledge | Verify transactions before making them |
| Audit security hotspots | Finding XSS in Apache Airflow, Hardcoded credentials |
| Audit configuration files | Find S3 ARN uses |
| Migrate from deprecated APIs | DES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs |
| Apply automatic fixes | Use listenAndServeTLS |
Extensions
Visit Docs > Extensions to learn about using Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!
Documentation
Browse the full Semgrep documentation on the website. If you’re new to Semgrep, check out Docs > Getting started or the interactive tutorial.
Metrics
Using remote configuration from the Registry (like --config=p/ci) reports pseudonymous rule metrics to semgrep.dev.
Using configs from local files (like --config=xyz.yml) does not enable metrics.
To disable Registry rule metrics, use --metrics=off.
The Semgrep privacy policy describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.
More
- Frequently asked questions (FAQs)
- Contributing
- Build instructions for developers
- Ask questions in the r2c Community Slack
- CLI reference and exit codes
- Semgrep YouTube channel
- License (LGPL-2.1)
Upgrading
To upgrade, run the command below associated with how you installed Semgrep:
# Using Homebrew
$ brew upgrade semgrep
# Using pip
$ python3 -m pip install --upgrade semgrep
# Using Docker
$ docker pull returntocorp/semgrep:latest
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Built Distributions
File details
Details for the file semgrep-1.13.0.tar.gz.
File metadata
- Download URL: semgrep-1.13.0.tar.gz
- Upload date:
- Size: 253.1 kB
- Tags: Source
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.2 CPython/3.9.16
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 83bbd3e75848827238668018feef9ac6ba3890c213013218fdc96f737f26bccc |
|
| MD5 | 73c58a00ff7552a3c819ca6a577f0892 |
|
| BLAKE2b-256 | 8152e0eb6f25257fad48029a7df35dd578220aa677fa244a11cb4bf6d2184ce7 |
File details
Details for the file semgrep-1.13.0-cp37.cp38.cp39.py37.py38.py39-none-macosx_11_0_arm64.whl.
File metadata
- Download URL: semgrep-1.13.0-cp37.cp38.cp39.py37.py38.py39-none-macosx_11_0_arm64.whl
- Upload date:
- Size: 27.3 MB
- Tags: CPython 3.7, CPython 3.8, CPython 3.9, Python 3.7, Python 3.8, Python 3.9, macOS 11.0+ ARM64
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.2 CPython/3.9.16
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 227bf7daf30e3715035b72dfeca74dc4cb50fdf6c4f624d3ea37e423cd36df72 |
|
| MD5 | 5aa278350c664c9ca66799d3aa8d2aea |
|
| BLAKE2b-256 | 33afb335a73494d716568e757475a2f716e4bb00fb4251d5a7f507d0c523d218 |
File details
Details for the file semgrep-1.13.0-cp37.cp38.cp39.py37.py38.py39-none-macosx_10_14_x86_64.whl.
File metadata
- Download URL: semgrep-1.13.0-cp37.cp38.cp39.py37.py38.py39-none-macosx_10_14_x86_64.whl
- Upload date:
- Size: 23.7 MB
- Tags: CPython 3.7, CPython 3.8, CPython 3.9, Python 3.7, Python 3.8, Python 3.9, macOS 10.14+ x86-64
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.2 CPython/3.9.16
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 5014d1249933be3deb3865b11be72eb91c4b592cabe84d729154485d5eb984a0 |
|
| MD5 | 7b002f3acd275b1d268b3e2c83abd648 |
|
| BLAKE2b-256 | a4c4f1bfe8d2b605aaabd77f1ac801477a83fdc919a29d6e801c4c60d112fb9a |
File details
Details for the file semgrep-1.13.0-cp37.cp38.cp39.py37.py38.py39-none-any.whl.
File metadata
- Download URL: semgrep-1.13.0-cp37.cp38.cp39.py37.py38.py39-none-any.whl
- Upload date:
- Size: 27.1 MB
- Tags: CPython 3.7, CPython 3.8, CPython 3.9, Python 3.7, Python 3.8, Python 3.9
- Uploaded using Trusted Publishing? No
- Uploaded via: twine/4.0.2 CPython/3.9.16
File hashes
| Algorithm | Hash digest | |
|---|---|---|
| SHA256 | 72ded8dde0350191c5f5f5440a03e8c97485b2bf7686b791e232168953c41ba0 |
|
| MD5 | 6bf53e34816c9466d4cde05fd465594f |
|
| BLAKE2b-256 | 3d6701d902bad7001d2e527f5e44f1f3587478f6fdc826bdb7f85755fe0709ea |
