What is Semgrep?
Semgrep is an application security platform with Semgrep Code (SAST), Semgrep Supply Chain (SCA for open-source dependencies) and Semgrep Secrets. Scans run through the Semgrep CLI (macOS, Linux, Windows in beta) in a CI job, and the web platform connects to GitHub, GitLab, Bitbucket and Azure DevOps; the vendor says AI is used for triage, remediation guidance, autofix, detection scans and agentic workflows.
Who it's for
Development and security teams that want code, dependency and secrets scanning in CI or on pull requests. Semgrep offers a Free Edition for organizations with up to 10 contributors, Teams for larger groups, and Enterprise for self-managed source control, custom CI/CD and dedicated support.
Pros & cons
Strengths
- Semgrep lists Code (SAST) and Supply Chain (SCA) at $0 per contributor on the Free Edition, with community support and unlimited public repositories.
- Semgrep's docs list the products as Code, Supply Chain and Secrets, and say the platform integrates with GitHub, GitLab, Bitbucket and Azure DevOps.
- Semgrep says AI pull request comments cost 0 credits and AI analysis (triage, remediation guidance, component tagging) costs 1 credit per finding.
- Semgrep's docs say its AI providers (default OpenAI, Amazon Bedrock and Cloudflare Workers AI) run under zero data retention agreements and do not use customer data to train their models.
- Semgrep's docs say customers can enroll in a minimal data retention policy through Support, and can request deletion of account data through Support.
- Semgrep's docs say Team and Enterprise customers can buy extra AI credits in 10,000-credit increments, and that bring-your-own-key options exist for some AI features (not for AI-powered detection scans).
Limitations
- Teams is priced per contributor and per product (Code $30, Supply Chain $30, Secrets $15 a month); Enterprise pricing is custom, and a contributor is anyone with a commit to a scanned private repository in the past 90 days.
- AI features use credits: 60 on Free (60 per month per the docs), 20 per contributor a month on Teams, 50 on Enterprise. AI Autofix costs 20 credits per finding, and when credits run out AI-powered detection scans, autofixes and agentic workflows stop while AI autotriage continues with a warning. Plan credits expire at contract end and do not roll over.
- The Free Edition does not list Secrets and has no SSO beyond GitHub/GitLab sign-in or RBAC; the pricing page lists private repository caps of 10 on Free and 500 on Teams. Scans stop when contributors exceed the Free limit of 10.
- Semgrep's docs say AI detection source data (prompts, responses, code snippets, scan reports) is kept up to 6 months, remediation data and memories are kept indefinitely, and AI-powered detection scans send full file contents to AI providers. The docs do not say whether Semgrep uses customer data to train its own models, and do not address regional data rules.
- Semgrep's own pages differ in places: the pricing page lists Secrets as included in Enterprise while the billing docs say Secrets licenses require contacting sales; the pricing page gives no period for Free AI credits; and the pricing page shows no annual billing while the billing docs mention only monthly credit-card billing for Teams.
Plans and pricing
- Free Edition: $0. Code and Supply Chain for up to 10 contributors; up to 10 private repositories; 60 AI credits; community support; GitHub/GitLab sign-in only.
- Teams: From $30 a month per contributor, billed monthly. Code $30, Supply Chain $30, Secrets $15 per contributor a month; up to 500 private repositories; 20 AI credits per contributor a month; OIDC and SAML SSO; RBAC.
- Enterprise: Custom. Contact sales; volume pricing; 50 AI credits per contributor a month; unlimited private repositories; self-managed source control and custom CI/CD; dedicated account manager.
Prices were read from semgrep.dev/pricing and Semgrep's billing docs, which show Teams per contributor per month in US dollars, with monthly credit-card billing and no mention of annual billing. The docs mention discounted startup pricing through a separate application form, and say refund and trial terms are not covered; no refund policy or trial length was found. Confirm on the live pricing page.
Details checked October 2026 against the vendor's own pages. Prices and limits change, so confirm before you buy. Official pricing page ↗
Sources
This profile was compiled from these public pages. We have not run hands-on tests.
Semgrep — at a glance
Semgrep is an application security platform with Semgrep Code (SAST), Semgrep Supply Chain (SCA for open-source dependencies) and Semgrep Secrets. Scans run through the Semgrep CLI (macOS, Linux, Windows in beta) in a CI job, and the web platform connects to GitHub, GitLab, Bitbucket and Azure DevOps; the vendor says AI is used for triage, remediation guidance, autofix, detection scans and agentic workflows.
Try Semgrep →