{
  "slug": "semgrep",
  "name": "Semgrep",
  "url": "https://semgrep.dev",
  "cat": "review",
  "group": "ship",
  "tagline": "SAST with custom rules",
  "price": "Semgrep Community Edition free under LGPL-2.1; hosted Free tier up to 10 contributors; Teams from $30/contributor/mo for Code or Supply Chain and $15 for Secrets; Enterprise custom",
  "tier": "mixed",
  "pick": false,
  "what": "Fast semantic static analysis across 30+ languages that matches patterns by code meaning rather than raw text, backed by a large community rule registry. The CLI is open source and runs locally or in CI with no account. Paid tiers add cross-file dataflow, reachability-aware SCA and validated secret detection.",
  "why": "Rules look like the code they match, so in five lines you can enforce whatever your AI keeps forgetting: every query goes through the parameterised helper, every route calls the auth middleware.",
  "warn": "Cross-file dataflow analysis, which finds most real injection paths, is a paid Pro rules feature. The free Community engine is largely single-file, so it misses taint that crosses modules.",
  "install": "brew install semgrep && semgrep scan --config auto",
  "category": {
    "key": "review",
    "name": "Code review, testing & security",
    "desc": "The single biggest risk in vibe coding is shipping AI code nobody read. This is the fix.",
    "group": "ship",
    "groupName": "Ship it & keep it alive"
  },
  "freshness": null,
  "health": {
    "ok": true,
    "status_code": 200,
    "final_url": "https://semgrep.dev/",
    "checked_at": "2026-08-19T00:17:14.278+00:00"
  },
  "corrected_at": null,
  "upstream_changed_at": null
}