Semgrep
Static analysis (SAST) and supply chain scanning platform with a powerful rule engine, cross-file Pro rules, and AI-assisted triage for 35+ languages.
Use Cases
Free Tier
Free Edition: scan up to 10 repositories with up to 10 contributors — Code (SAST) and Supply Chain (SCA) at $0, 60 AI credits/month
How to Maximize the Free Tier
The Free Edition covers Code (SAST) and Supply Chain (SCA) for up to 10 contributors across 10 repositories — enough for a solo dev with a few active repos. Watch the repo cap: every private repo you connect counts, and a contributor is anyone who committed to a scanned private repo in the past 90 days, so sharing a repo with collaborators eats into the 10-contributor limit fast. Run the open-source Semgrep CLI locally (`semgrep scan`) for unlimited scanning outside the cloud platform, and add the GitHub Action so PRs get findings inline. Spend your 60 monthly AI credits on triage of real findings, not exploratory scans. Combine with Trivy for container scanning and Gitleaks for secrets.
Getting Started
Sign up at semgrep.dev with GitHub/GitLab → connect a repository → push a commit to trigger a cloud scan → add the Semgrep GitHub Action to comment findings on PRs → review and triage issues in the dashboard.
Pros
- Generous free tier: Code (SAST) + Supply Chain (SCA) free for up to 10 contributors and 10 repositories
- Pro rules included: Cross-file taint analysis and Pro rulesets are included on the free plan, not gated behind a trial
- Local CLI: The open-source Semgrep engine runs unlimited scans locally and in CI without the cloud platform
Cons
- Repo cap: Free plan is limited to 10 repositories — larger portfolios must upgrade to Teams
- Contributor counting: Anyone who commits to a scanned private repo within 90 days counts toward the 10-contributor limit, so shared repos burn the cap fast
- AI credits: Only 60 AI credits per month for AI-powered triage and remediation — active development exhausts them quickly