semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Showing:

Popularity

Downloads/wk

0

GitHub Stars

5.4K

Maintenance

Last Commit

2d ago

Contributors

77

Package

Dependencies

12

License

Categories

Readme

Semgrep logo

Lightweight static analysis for many languages.
Find bugs and enforce code standards.

Homebrew PyPI Documentation Join Semgrep community Slack Issues welcome! 4000+ GitHub stars Follow @r2cdev on Twitter


Semgrep is a fast, open-source, static analysis tool for finding bugs and enforcing code standards at editor, commit, and CI time. Get started →.

Semgrep analyzes code locally on your computer or in your build environment: code is never uploaded.

Its rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python print() statements, run it online in Semgrep's Playground by clicking the image:

Semgrep rule example for finding Python print() statements

The Semgrep ecosystem includes:

  • Semgrep - the open-source command line tool at the heart of everything (this project)
  • Semgrep CI - a specialized Docker image for running Semgrep in CI environments
  • Semgrep Playground - an online interactive editor for writing and sharing rules
  • Semgrep Registry - 1,000+ community-driven rules covering security, correctness, and performance bugs
  • Semgrep App - deploy, manage, and monitor Semgrep at scale with free and paid tiers.

Join 100,000 other developers and security engineers already using Semgrep at companies like Chef, Dropbox, Figma, HashiCorp, Snowflake, and Trail of Bits. Also check out tools powered by Semgrep!

Semgrep is developed and commercially supported by r2c, a software security company.

Language support

General availability

Go · Java · JavaScript · JSX · JSON · Python · Ruby · TypeScript · TSX

Beta & experimental

See supported languages for the complete list.

Getting started

To install Semgrep use Homebrew or pip, or run without installation via Docker:

# For macOS
$ brew install semgrep

# For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep

# To try Semgrep without installation run via Docker
$ docker run --rm -v "${PWD}:/src" returntocorp/semgrep --help

Once installed, Semgrep can run with single rules or entire rulesets. Visit Docs > Running rules to learn more or try the following:

# Check for Python == where the left and right hand sides are the same (often a bug)
$ semgrep -e '$X == $X' --lang=py path/to/src

# Run the r2c-ci ruleset (with rules for many languages) on your own code!
$ semgrep --config=p/r2c-ci path/to/src

Visit the full documentation to learn more.

Rule examples

Visit Docs > Rule examples for use cases and ideas.

Use caseSemgrep rule
Ban dangerous APIsPrevent use of exec
Search routes and authenticationExtract Spring routes
Enforce the use secure defaultsSecurely set Flask cookies
Tainted data flowing into sinksExpressJS dataflow into sandbox.run
Enforce project best-practicesUse assertEqual for == checks, Always check subprocess calls
Codify project-specific knowledgeVerify transactions before making them
Audit security hotspotsFinding XSS in Apache Airflow, Hardcoded credentials
Audit configuration filesFind S3 ARN uses
Migrate from deprecated APIsDES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs
Apply automatic fixesUse listenAndServeTLS

Extensions

Visit Docs > Extensions to learn about Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!

Documentation

Browse the full Semgrep documentation on the website. If you’re new to Semgrep, check out Docs > Getting started or the interactive tutorial.

Metrics

Using remote configuration from the Registry (like --config=p/ci) reports pseudonymous rule metrics to semgrep.dev.

Using configs from local files (like --config=xyz.yml) does not enable metrics.

To disable Registry rule metrics, use --metrics=off.

PRIVACY.md describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.

More

Upgrading

To upgrade, run the command below associated with how you installed Semgrep:

# Using Homebrew
$ brew upgrade semgrep

# Using pip
$ python3 -m pip install --upgrade semgrep

# Using Docker
$ docker pull returntocorp/semgrep:latest

Rate & Review

Great Documentation0
Easy to Use0
Performant0
Highly Customizable0
Bleeding Edge0
Responsive Maintainers0
Poor Documentation0
Hard to Use0
Slow0
Buggy0
Abandoned0
Unwelcoming Community0
100
No reviews found
Be the first to rate

Alternatives

No alternatives found

Tutorials

No tutorials found
Add a tutorial