Semgrep
Pattern-based code scanning you can run locally or connect to GitHub, with a free cloud tier for small teams.
Last updated
- Free tier
- Yes
- Checked
- 2026-10-13
What the public pages say
Semgrep is a practical scanner when you want rules aimed at source code, including custom rules later. The hosted free tier and the open-source CLI are different products. The README on the GitHub project says the community CLI will miss issues that cross function or file boundaries.
The pricing page also says that if Semgrep runs locally or fully in your CI, source code stays there and only run metadata is sent, unless you opt into managed scans or their AI features, which have different data handling described on that page.
Free tier
Semgrep's pricing page says you can get started for free, with no charge for up to 10 contributors. Highlights listed there include scanning up to 10 repositories and 60 AI credits. The comparison table lists a maximum of 10 private repositories on the free edition and unlimited public repositories. The free edition's included products are listed as Code (SAST) and Supply Chain at $0 per contributor. Secrets detection is listed on the Teams plan at $15 per contributor per month, not in the free plan's included-products line.
Not stated on the vendor's site
- The open-source license name. The Semgrep GitHub README says Community Edition only analyzes code within a single function or file, and that the AppSec platform adds cross-file analysis.
Sources
Markdown version · Canonical page: https://shipsecurely.dev/tools/semgrep