Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit

The list of targets discovered by pysemgrep is no longer accompanied by
the list of rules applying to each target. Determining which rule
applies to a target is now done by in OCaml by semgrep-core. This
includes applying the per-rule target exclusions (`include`, `exclude`)
which was already in place and checking that the target's intended
analyzer ("language") is one of those supported by the rule (I had to
add this).

This is meant to reduce the memory needed to load the targets, since
each target path used to come with a list of rule IDs and it could be

* I didn't check for the performance of the new implementation.
* There may be more filtering involved than necessary since we're not
clustering rules by language/analyzer like we could and instead we go
through the whole list of rules for each target so select the subset of
applicable rules.
* I didn't get to remove much Python code. It will shrink when we remove
the splitting of tasks by language.


Co-authored-by: Martin Jambon <>

Git stats


Failed to load latest commit information.
Latest commit message
Commit time

Semgrep logo

Code scanning at ludicrous speed.

Homebrew PyPI Documentation Join Semgrep community Slack Issues welcome! Star Semgrep on GitHub Docker Pulls Follow @semgrep on Twitter

Semgrep is a fast, open-source, static analysis engine for finding bugs, detecting vulnerabilities in third-party dependencies, and enforcing code standards. Semgrep analyzes code locally on your computer or in your build environment: code is never uploaded. Get started →.

Semgrep CLI image

Language support

Semgrep supports 30+ languages.

Category Languages
GA C# · Go · Java · JavaScript · JSX · JSON · PHP · Python · Ruby · Scala · Terraform · TypeScript · TSX
Beta Kotlin · Rust
Experimental Bash · C · C++ · Clojure · Dart · Dockerfile · Elixir · HTML · Julia · Jsonnet · Lisp · Lua · OCaml · R · Scheme · Solidity · Swift · YAML · XML · Generic (ERB, Jinja, etc.)

Getting started 🚀

  1. From the CLI
  2. From the Semgrep Cloud Platform

For beginners, we recommend starting with the Semgrep Cloud Platform because it provides a visual interface, a demo project, result triaging and exploration workflows, and makes setup in CI/CD fast. Scans are still local and code isn't uploaded. Alternatively, you can also start with the CLI without logging in and navigate the terminal output to run one-off searches.

Option 1: Getting started from the CLI

  1. Install Semgrep CLI
# For macOS
$ brew install semgrep

# For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep

# To try Semgrep without installation run via Docker
$ docker run --rm -v "${PWD}:/src" returntocorp/semgrep semgrep
  1. Go to your app's root directory and run semgrep scan --config auto. This will scan your project with the default settings.

  2. [Optional, but recommended] Run semgrep login to get the login URL for the Semgrep Cloud Platform. Open the login URL in the browser and login.

Semgrep platform image

  1. Register to

  2. Explore the demo app

  3. Scan your project by navigating to Projects > Scan New Project > Run scan in CI

  4. Select your version control system and follow the wizard to add your project. After this setup, Semgrep will scan your project after every pull request.

  5. [Optional but recommended] If you want to run Semgrep locally, follow the steps in the CLI section.


  1. Visit Docs > Running rules to learn more about auto config and other rules.

  2. If there are any issues, please ask for help in the Semgrep Slack

  3. To run Semgrep Supply Chain, contact the Semgrep team. Visit the full documentation to learn more.

Semgrep Ecosystem

The Semgrep ecosystem includes the following products:

  • Semgrep OSS Engine - The open-source engine at the heart of everything (this project).
  • Semgrep Cloud Platform (SCP) - Deploy, manage, and monitor SAST and SCA at scale using Semgrep, with free and paid tiers. Integrates with continuous integration (CI) providers such as GitHub, GitLab, CircleCI, and more.
  • Semgrep Code - Scan your code with Semgrep's Pro rules and Semgrep Pro Engine to find OWASP Top 10 vulnerabilities and protect against critical security risks specific to your organization. Semgrep Code is available on both free and paid tiers.
  • Semgrep Supply Chain (SSC) - A high-signal dependency scanner that detects reachable vulnerabilities in open source third-party libraries and functions across the software development life cycle (SDLC). Semgrep Supply Chain is available on both free and paid tiers.


  • Semgrep Playground - An online interactive tool for writing and sharing rules.
  • Semgrep Registry - 2,000+ community-driven rules covering security, correctness, and dependency vulnerabilities.

Join hundreds of thousands of other developers and security engineers already using Semgrep at companies like GitLab, Dropbox, Slack, Figma, Shopify, HashiCorp, Snowflake, and Trail of Bits.

Semgrep is developed and commercially supported by Semgrep, Inc., a software security company.

Semgrep Rules

Semgrep rules look like the code you already write; no abstract syntax trees, regex wrestling, or painful DSLs. Here's a quick rule for finding Python print() statements.

Run it online in Semgrep’s Playground by clicking here.

Semgrep rule example for finding Python print() statements


Visit Docs > Rule examples for use cases and ideas.

Use case Semgrep rule
Ban dangerous APIs Prevent use of exec
Search routes and authentication Extract Spring routes
Enforce the use secure defaults Securely set Flask cookies
Tainted data flowing into sinks ExpressJS dataflow into
Enforce project best-practices Use assertEqual for == checks, Always check subprocess calls
Codify project-specific knowledge Verify transactions before making them
Audit security hotspots Finding XSS in Apache Airflow, Hardcoded credentials
Audit configuration files Find S3 ARN uses
Migrate from deprecated APIs DES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs
Apply automatic fixes Use listenAndServeTLS


Visit Docs > Extensions to learn about using Semgrep in your editor or pre-commit. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!


Browse the full Semgrep documentation on the website. If you’re new to Semgrep, check out Docs > Getting started or the interactive tutorial.


Using remote configuration from the Registry (like --config=p/ci) reports pseudonymous rule metrics to

Using configs from local files (like --config=xyz.yml) does not enable metrics.

To disable Registry rule metrics, use --metrics=off.

The Semgrep privacy policy describes the principles that guide data-collection decisions and the breakdown of the data that are and are not collected when the metrics are enabled.



To upgrade, run the command below associated with how you installed Semgrep:

# Using Homebrew
$ brew upgrade semgrep

# Using pip
$ python3 -m pip install --upgrade semgrep

# Using Docker
$ docker pull returntocorp/semgrep:latest