Semgrep — Lightweight Static Analysis for Any Language

Introduction

Semgrep makes static analysis accessible. Traditional SAST tools require learning complex query languages or AST manipulation. Semgrep rules look like the code you are searching for — write a pattern in Python syntax to find Python bugs, in JavaScript syntax to find JavaScript issues. If you can read code, you can write Semgrep rules.

With over 15,000 GitHub stars, Semgrep supports 30+ languages and has a community rule registry with thousands of pre-built rules for security, correctness, and best practices. It is used by Dropbox, Figma, Snowflake, and hundreds of security teams.

What Semgrep Does

Semgrep parses source code into an AST and matches patterns against it. Patterns use a code-like syntax with metavariables ($X) for wildcards and operators (...) for matching any code. It finds bugs, security vulnerabilities, anti-patterns, and enforces coding standards — all without compiling the code.

Architecture Overview

[Source Code]
30+ languages supported
        |
   [Semgrep Engine (OCaml)]
   Language-aware parsing
   Pattern matching on ASTs
        |
   [Rules (YAML)]
+-------+-------+
|       |       |
[Community [Custom  [Semgrep
Rules]     Rules]   Registry]
p/security Your org 3,000+
p/owasp    specific rules
p/python   rules   from community
        |
   [Pattern Matching]
   $VAR    = metavariable
   ...     = match anything
   Taint tracking
   Constant propagation
        |
   [Results]
   CLI, JSON, SARIF
   GitHub/GitLab integration

Self-Hosting & Configuration

# .semgrep.yml — custom rule example
rules:
  - id: sql-injection-risk
    patterns:
      - pattern: |
          cursor.execute("..." + $USER_INPUT)
    message: |
      Possible SQL injection: use parameterized queries
      instead of string concatenation.
    languages: [python]
    severity: ERROR
    metadata:
      cwe: CWE-89
      owasp: A03:2021

  - id: no-eval
    pattern: eval(...)
    message: Avoid eval() — it executes arbitrary code.
    languages: [python, javascript]
    severity: WARNING

  - id: use-strict-equality
    pattern: $X == $Y
    fix: $X === $Y
    message: Use strict equality (===) instead of loose equality (==).
    languages: [javascript, typescript]
    severity: INFO

# CI/CD integration
# GitHub Actions:
# - uses: returntocorp/semgrep-action@v1
#   with:
#     config: p/security-audit

# Run with autofix
semgrep --config .semgrep.yml --autofix .

# Output SARIF for GitHub Security
semgrep --config auto --sarif -o results.sarif .

Key Features

• Code-Like Patterns — write rules that look like source code
• 30+ Languages — Python, JS/TS, Java, Go, Ruby, C, PHP, and more
• Metavariables — $X matches any expression for flexible patterns
• Taint Analysis — track data flow from sources to sinks
• Autofix — automatically fix issues with fix patterns
• Community Rules — 3,000+ pre-built rules in the registry
• CI/CD — GitHub Actions, GitLab CI, and SARIF output
• Fast — scans large codebases in seconds (no compilation needed)

Comparison with Similar Tools

FAQ

Q: Semgrep vs ESLint — when should I use Semgrep? A: Use ESLint for JavaScript/TypeScript linting and formatting rules. Use Semgrep for security scanning across multiple languages, custom organizational rules, and taint analysis.

Q: Can Semgrep replace SonarQube? A: For security scanning, Semgrep is faster to set up and easier to customize. SonarQube provides more comprehensive code quality metrics, technical debt tracking, and enterprise features.

Q: How do I write custom rules? A: Start at semgrep.dev/playground — paste your code, write a pattern, and test it interactively. Rules use YAML with code-like patterns. The docs have a tutorial that takes 30 minutes.

Q: What is Semgrep Pro? A: Semgrep Pro (cloud) adds inter-file analysis, AI-assisted triage, and team management. The open-source CLI with community rules is free and sufficient for many teams.

Sources

• GitHub: https://github.com/semgrep/semgrep
• Documentation: https://semgrep.dev/docs
• Playground: https://semgrep.dev/playground
• Created by Semgrep (formerly r2c)
• License: LGPL-2.1