You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
mschwager 6c07e59f16
Support many suffix delimiters in filename, only check end (#2921)
14 hours ago
.circleci Use ocaml ruleset in policy (#2833) 3 weeks ago
.github Revert change of tap (#2897) 6 days ago
.vscode add pre-commit 1 year ago
doc Add benchmarking info to README (#2905) 4 days ago
dockerfiles Add dockerfile into container as /Dockerfile (#2814) 3 weeks ago
ocaml-tree-sitter@817c6de84a Fix 'make setup', which was not updating the tree-sitter runtime library (#2525) 2 months ago
perf [JSON] fix partial single field pattern (#2915) 1 day ago
scripts fix: Add workaround for bintray brownout (#2922) 15 hours ago
semgrep Support many suffix delimiters in filename, only check end (#2921) 14 hours ago
semgrep-core Rust: Support top-level statements (#2910) 22 hours ago
spacegrep Fix the 'unique_id' field of metavariable captures in json exported by spacegrep (#2803) 3 weeks ago
stubs Improve jsonschema error when missing top-level key (#1642) 7 months ago
toy-matcher Upgrade tree sitter (#2512) 2 months ago
.dockerignore Add dockerfile into container as /Dockerfile (#2814) 3 weeks ago
.gitignore Add gitignore for compiled binaries (#2758) 4 weeks ago
.gitmodules Move semgrep-core sources to semgrep-core/src (#2729) 1 month ago
.ocp-indent minimal typescript support (#1634) 7 months ago
.pre-commit-config.yaml Remove unused imports (#2811) 3 weeks ago
.pre-commit-hooks.yaml Add python backed pre-commit hook (#1401) 8 months ago
.semgrepignore Split ocaml-tree-sitter-lang into one repo per language (#2515) 2 months ago Support many suffix delimiters in filename, only check end (#2921) 14 hours ago Update Code of Conduct to Contributor Covenant v2 (#2126) 4 months ago Minor doc changes (#2759) 4 weeks ago
Dockerfile Adding the new Comby OPAM package as a dependency (#2844) 5 days ago
LICENSE revert moving the files to docs folder because it breaks Github convention and UI 1 year ago
Makefile Move semgrep-core sources to semgrep-core/src (#2729) 1 month ago Readme updates (#2543) 2 months ago Fix spelling mistakes/typos in documentation (#1325) 9 months ago
mypy-tests.ini Bump pre-commit hooks (#2100) 5 months ago
mypy.ini Use copied junit_xml instead of external dependency (#2895) 6 days ago
semgrep.svg Update semgrep logo (#2492) 2 months ago
semgrep.yml Move semgrep-core sources to semgrep-core/src (#2729) 1 month ago Merge pull request #2908 from returntocorp/release-0.46.0 4 days ago

Semgrep logo

Lightweight static analysis for many languages.
Find bugs and enforce code standards.

Homebrew PyPI Issues welcome! Issues welcome! 1500+ GitHub stars Follow @r2cdev

Semgrep is a fast, open-source, static analysis tool that finds bugs and enforces code standards at editor, commit, and CI time. Precise rules look like the code you’re searching; no more traversing abstract syntax trees, wrestling with regexes, or using a painful DSL. Code analysis is performed locally (code is not uploaded) and Semgrep runs on uncompiled code.

The Semgrep Registry has 1,000+ rules written by the Semgrep community covering security, correctness, and performance bugs. No need to DIY unless you want to.

Semgrep is used in production everywhere from one-person startups to multi-billion dollar companies; it’s the engine inside tools like NodeJsScan. See tools powered by Semgrep.

Semgrep is developed and commercially supported by r2c, a software security company. r2c’s hosted service, Semgrep App, lets organizations easily deploy in CI, manage rules across many projects, monitor the efficacy of code policy, and integrate with 3rd-party services. r2c offers free and paid hosted tiers (see pricing).

Language support

General availability

Go · Java · JavaScript · JSX · JSON · Python · Ruby · TypeScript · TSX

Beta & experimental

See supported languages for the complete list.

Getting started

To install Semgrep use Homebrew or pip, or run without installation via Docker:

# For macOS
$ brew install semgrep

# For Ubuntu/WSL/Linux/macOS
$ python3 -m pip install semgrep

# To try Semgrep without installation run via Docker
$ docker run --rm -v "${PWD}:/src" returntocorp/semgrep --help

Once installed, Semgrep can run with single rules or entire rulesets. Visit Running rules to learn more or try the following:

# Check for Python == where the left and right hand sides are the same (often a bug)
$ semgrep -e '$X == $X' --lang=py path/to/src

# Run the r2c-ci ruleset (with rules for many languages) on your own code!
$ semgrep --config=p/r2c-ci path/to/src

Visit Getting started to learn more.

Rule examples

Visit Rule examples for use cases and ideas. There is also an excellent interactive tutorial.

Use case Semgrep rule
Ban dangerous APIs Prevent use of exec
Search routes and authentication Extract Spring routes
Enforce the use secure defaults Securely set Flask cookies
Enforce project best-practices Use assertEqual for == checks, Always check subprocess calls
Codify project-specific knowledge Verify transactions before making them
Audit security hotspots Finding XSS in Apache Airflow, Hardcoded credentials
Audit configuration files Find S3 ARN uses
Migrate from deprecated APIs DES is deprecated, Deprecated Flask APIs, Deprecated Bokeh APIs
Apply automatic fixes Use listenAndServeTLS


Visit Integrations to learn about Semgrep editor, commit, and CI integrations. When integrated into CI and configured to scan pull requests, Semgrep will only report issues introduced by that pull request; this lets you start using Semgrep without fixing or ignoring pre-existing issues!



To upgrade, run the command below associated with how you installed Semgrep:

# Using Homebrew
$ brew upgrade semgrep

# Using pip
$ python3 -m pip install --upgrade semgrep

# Using Docker
$ docker pull returntocorp/semgrep:latest