Semgrepvs
Veracode
Veracode: Competing SAST and software composition analysis platform for enterprise application security.
Semgrep
Open-source static analysis tool for finding security bugs and enforcing code standards.
As of 29 August 2026, Semgrep has a free plan and paid plans start at $30/month. Static analysis security tool that scans code and dependencies for vulnerabilities using fast, customizable rules. Softwr lists it under Cybersecurity. Semgrep is made by Semgrep, Inc., available on Web, API, Linux, macOS.
Overview
What Semgrep does
Semgrep is a static analysis platform that scans source code and software supply chains for security vulnerabilities, using a lightweight open-source rule engine alongside a commercial cloud platform for teams. It offers cross-file analysis, AI-powered detection and triage, and a Secrets scanning product, integrating into CI/CD pipelines to catch issues such as injection flaws, hardcoded credentials, and vulnerable dependencies before code ships.
What people use it for
- Scanning code for security vulnerabilities in CI/CD
- Detecting vulnerable open-source dependencies
- Finding hardcoded secrets before code ships
- Enforcing custom code standards with rule sets
- Prioritizing findings with AI-assisted triage
Related searches
The honest half
Where it falls short
Concrete and checkable, so you can decide whether any of them matter to you. This is the half of a review a vendor will not write about Semgrep.
- Free tier caps out at 10 contributors and 10 repositories.
- Secrets scanning is priced as a separate module ($15/contributor) from Code and Supply Chain.
- Self-managed repositories and custom CI/CD require the Enterprise tier.
- AI credits are limited per tier and additional usage requires upgrading.
Cross-shopped
What people choose instead of Semgrep
Each pairing was judged by two reviewers asking whether a buyer would genuinely weigh the two against each other. The ones that failed were deleted rather than published.
Pricing
What Semgrep costs
Taken from the vendor's own pricing page. Prices move, so check before you buy.
Free
Free
- Up to 10 contributors
- Code and Supply Chain scanning
- 60 AI credits total
- Up to 10 repositories
Teams
$30 /mo
- Code, Supply Chain, or Secrets scanning per contributor
- Pro rules
- AI-powered triage and remediation
- 20 AI credits per developer/month
- SSO
Enterprise
On request
- On-prem support
- Custom CI/CD
- 50 AI credits per developer/month
- Unlimited repositories and contributors
- Dedicated account manager
Capabilities
Features
Static code scanning
Rule-based static analysis across dozens of programming languages
Supply chain scanning
Detects vulnerable and malicious open-source dependencies
Secrets detection
Finds hardcoded credentials and exposed secrets in code
Cross-file analysis
Traces data flow across multiple files to reduce false positives
AI-powered triage and remediation
Uses AI to prioritize findings and suggest fixes
CI/CD integration
Runs scans in pull requests and CI pipelines
Answered, with sources
Questions people ask
Each answer names the page it came from, so you can check it rather than take our word for it.
What does Semgrep cost?
The Free edition covers up to 10 contributors; Teams starts at $30/contributor/month for Code scanning (Supply Chain also $30, Secrets $15); Enterprise is custom-priced.
SourceIs there a free plan, and what are its limits?
Yes, the Free edition supports up to 10 contributors and 10 repositories with Code and Supply Chain scanning plus 60 AI credits total.
SourceHow is usage metered?
Pricing is per contributor, defined as someone who made at least one commit to a scanned private repository in the past 90 days.
SourceIs there special pricing for startups?
Yes, Semgrep offers special startup pricing upon request for early-stage companies.
SourceKeep looking
Where to go from Semgrep
- Semgrep alternativesEvery product people weigh against it
- Semgrep pricingPlans, floors and what the tiers exclude
- Semgrep badgesWhich rules it meets, and the figure behind each
- All Cybersecurity softwareThe full category
- Best Cybersecurity softwareThe shortlist, and how it was cut
Best Cybersecurity software for
Compare Semgrep with
- Veracode
- Arnica
- Trivy
- Grype
- Snyk
- Bitwarden
- Infisical
- Chainguard
- Authelia
- HashiCorp Vault
- Ory Kratos
- authentik
- SentinelOne Singularity
- Shufti Pro
- Signicat
- Silent Eight
- Socket
- Socure
Other Cybersecurity software
Application risk management platform for finding and fixing software vulnerabilities.
Pricing on request8 researched notesAI-native application security platform detecting and fixing vulnerabilities across the SDLC
Free, then $300/yr11 researched notesSecure-by-default open source software with hardened container images and libraries
Free, then $19,000/yr11 researched notesOpen-source authentication and two-factor portal for reverse proxies
Open source9 researched notesOpen-source identity provider with flexible authentication flows
Free plan9 researched notesIdentity verification and AML screening at the low cost end of the market
Pricing on request11 researched notesEuropean digital identity hub connecting national eID schemes
Pricing on request10 researched notesAI adjudication of sanctions screening and AML alerts
Pricing on request10 researched notesSupply chain security platform detecting and blocking malicious dependencies
Free, then $25/mo11 researched notesPredictive identity verification and fraud scoring for the US market
Pricing on request11 researched notes
Softwr does not host reviews and shows no star rating for Semgrep, because a rating we did not collect is not ours to publish. What is here is the pricing and platform detail from the vendor’s own pages, limitations we could state concretely, and alternatives a reviewer confirmed people weigh against it. Tell us if any of it is wrong.
More on Semgrep
Semgrep alternatives
What people switch to, and what they give up
Semgrep pricing
Every tier, and where the cost actually lands
Compare Semgrep
Put it head to head with anything we hold
Semgrep badge
Its rating, and an embed for your own site
Best Cybersecurity software alternatives
Large Chinese video platform that US federal buyers and federal contractors cannot lawfully use
quote
Managed video loss prevention with human auditors for restaurants, convenience stores and retail
quote
Workforce and customer authentication from a certificate authority
Per user per month
Privileged access management, endpoint privilege management and secure remote access
quote
Cloud video surveillance billed per camera per month, where retention length drives the bill more than anything else
Per camera per month
AI video search that runs on cameras you already own, starting near five dollars per camera per month
Per camera per month
Phishing-resistant passwordless authentication with device trust enforced at every login
quote